From nobody Tue Jul 5 13:14:35 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6DDC812B050 for ; Tue, 5 Jul 2016 13:14:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.601 X-Spam-Level: X-Spam-Status: No, score=-102.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QGfylb0eL-hC for ; Tue, 5 Jul 2016 13:14:31 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0a-0018ba01.pphosted.com [67.231.149.94]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EB53612B03E for ; Tue, 5 Jul 2016 13:14:30 -0700 (PDT) Received: from pps.filterd (m0078664.ppops.net [127.0.0.1]) by mx0a-0018ba01.pphosted.com (8.16.0.17/8.16.0.17) with SMTP id u65KDWlE023827; Tue, 5 Jul 2016 16:14:30 -0400 Received: from stntexhc11.cis.neustar.com ([156.154.17.216]) by mx0a-0018ba01.pphosted.com with ESMTP id 23x88ut43w-1 (version=TLSv1 cipher=AES128-SHA bits=128 verify=NOT); Tue, 05 Jul 2016 16:14:30 -0400 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.94]) by stntexhc11.cis.neustar.com ([::1]) with mapi id 14.03.0279.002; Tue, 5 Jul 2016 16:14:28 -0400 From: "Peterson, Jon" To: Russ Housley , IETF STIR Mail List Thread-Topic: [stir] Using PASSporT with things other than STIR Thread-Index: AQHRzZPxSpbHwRlIsEOi8lEpAI9J8qAKJjIA Date: Tue, 5 Jul 2016 20:14:28 +0000 Message-ID: References: <518D00E4-784D-499B-B989-265AFC579F08@brianrosen.net> <7594FB04B1934943A5C02806D1A2204B3802BE3B@ESESSMB209.ericsson.se> <7594FB04B1934943A5C02806D1A2204B3802C104@ESESSMB209.ericsson.se> <01f41eda-4484-e891-bbae-b85eabdf8254@nostrum.com> <2fe6853c-8e83-77d1-e9fc-8848a1387ab9@nostrum.com> <66BCE048-8119-46CF-ACB6-03E5ACEDC8FB@vigilsec.com> In-Reply-To: <66BCE048-8119-46CF-ACB6-03E5ACEDC8FB@vigilsec.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.6.3.160329 x-originating-ip: [10.96.12.185] Content-Type: text/plain; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-07-05_10:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1607050179 Archived-At: Subject: Re: [stir] Using PASSporT with things other than STIR X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Jul 2016 20:14:33 -0000 I agree with that we need to nail this stuff down before we ship the PASSporT spec. >Can we offer any advice to the developer to help them decide when it is >necessary to use an alternate set of claims? Also, can we offer any >advice regarding the properties that are needed to determine if an >alternate claim set meets the security requirements? For example, >during the development of STIR we wanted to prevent cut-and-paste >attacks. This is a big one, I think. Pretty much any alternate set of claims would need to meet some minimum security bar, like preventing cut-and-paste attacks. There's a lot of language in RFC4474bis about why we think the set of claims baseline PASSporT provides is sufficient for securing calls. I think what we need to say here is pretty much that any specification of an alternative set of claims needs a similar explanation of what threats they prevent and what assurances they provide. Otherwise, we could for example end up with an alternative PASSporT with one claim - like, just the calling telephone number - which could easily be cut-and-pasted by any attacker, and yet a SIP message containing it would appear valid and secure, even though it offers no protections beyond RFC3325, basically. >Are there any implications on interoperability for adopting a different >set of claims? I do worry about "proprietary" one-offs that potentially could create a needless interoperability failure. It's better to extend the bare minimum when possible than it is do define a completely separate set of base claims, as even if the recipient of an extended object doesn't understand the additional data, it can still use the baseline to validate basic Identity. Probably, we should only encourage people to adopt an alternative set of claims that it not a superset of the PASSporT bare minimum for applications that are genuinely distinct from the semantics of placing a telephone call - pretty much anything that looks like a telephone call will have the same requirements for the called/calling party numbers (or URIs) and Date. >Can we offer any guidance that tells the developer when it would >be better to start fresh with JOSE JWS instead of trying to adjust >PASSporT? In other words, where should one try to apply the >PASSporT framework, and where should one not bother. If we only want to reserve alternative claims for use cases that don't even look like telephone calls, presumably we'd want to say that PASSporT is scoped to real-time personal communications, and that for uses that are not salient to that, something building on baseline JWS would be more appropriate? Jon Peterson Neustar, Inc. From nobody Tue Jul 5 16:42:36 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 28E0912B02F for ; Tue, 5 Jul 2016 16:42:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=chriswendt-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Dz1hUxlsj4bx for ; Tue, 5 Jul 2016 16:42:33 -0700 (PDT) Received: from mail-qt0-x232.google.com (mail-qt0-x232.google.com [IPv6:2607:f8b0:400d:c0d::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 43FE912B032 for ; Tue, 5 Jul 2016 16:42:33 -0700 (PDT) Received: by mail-qt0-x232.google.com with SMTP id c34so109048782qte.0 for ; Tue, 05 Jul 2016 16:42:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chriswendt-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=CE3mgUQgITpO6YZ6A0z1c5yN7pF6skeyQvpAl3J/hIc=; b=DbF036bzCeEEGu2i8RIZNCj1+XwaC6HUfbDBltA+eyYHo7Uul5Dzqy8lCUiyi+IxBV uK7YRu/HvvGC/PCTxjbbewAogJl7m6mBrDsBMI6dznDPHZxE6nr5uEVTvYTH6Lhv9bMi 353tJLO0HVpqiGfZ/hGr9TF5DX7+Ba9QUx5PV70wOUnLJluw80nD0Z832Or8nyf5FWxa 8EcZC4BMIjtl/FsRbkYOymBo73gcmcfOynbUvjQVFqk+22OO4HytYOknbH9tf9QVVWoA +Mbti0ADeVDYxj/nJvNAjkTEtLJbmab1HZUxV//S9cTSiE0BKpVNGwbek4Robgb3mZXK OlXg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=CE3mgUQgITpO6YZ6A0z1c5yN7pF6skeyQvpAl3J/hIc=; b=gJwW/u7ImXPGaD4D1P30TKd5QCcWlJ3qjlZn+aXoNiwsvfUUoRHGOOwvvV1ga//1gM G0+CRWHPTUzkHXqbwkxZaYLc52Jm/xsoPGW1BFaHZJvc8Y7LOSVNgj/KpZcbRJTaHbwm 864vcrTZD9kEtVclt4MSYKHeZbY4I2yxIe91wJdm+0gOznEozd6Pcp75jIZ5lYb4kTPe dgBq7ZGPXsis7Lf3zqZ1/DO2/5fiZDDiuaxVvpR55G/FqDwdKwqP/1qWrzF6GciJzdPM ymYlpGI/amgsVEWiOO3hM9ULpURqck5aAz8INHiLVQqJ/6dBqFvpKEGfbdhxPKDhmDYM mUbQ== X-Gm-Message-State: ALyK8tJpOu7e0lHxaarCzrU+UBPuKrnfM72OLeFgoYkJDRM3Bhu+VOmmT0mNWP9tU/+cRA== X-Received: by 10.237.40.99 with SMTP id r90mr31258484qtd.0.1467762152251; Tue, 05 Jul 2016 16:42:32 -0700 (PDT) Received: from ?IPv6:2601:41:c101:9364:b0d7:1e24:8922:33a5? ([2601:41:c101:9364:b0d7:1e24:8922:33a5]) by smtp.gmail.com with ESMTPSA id s25sm2630051qts.48.2016.07.05.16.42.31 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 05 Jul 2016 16:42:31 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Chris Wendt In-Reply-To: Date: Tue, 5 Jul 2016 19:42:30 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: References: <518D00E4-784D-499B-B989-265AFC579F08@brianrosen.net> <7594FB04B1934943A5C02806D1A2204B3802BE3B@ESESSMB209.ericsson.se> <7594FB04B1934943A5C02806D1A2204B3802C104@ESESSMB209.ericsson.se> <01f41eda-4484-e891-bbae-b85eabdf8254@nostrum.com> <2fe6853c-8e83-77d1-e9fc-8848a1387ab9@nostrum.com> <66BCE048-8119-46CF-ACB6-03E5ACEDC8FB@vigilsec.com> To: "Peterson, Jon" X-Mailer: Apple Mail (2.3124) Archived-At: Cc: IETF STIR Mail List , Russ Housley Subject: Re: [stir] Using PASSporT with things other than STIR X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Jul 2016 23:42:35 -0000 > On Jul 5, 2016, at 4:14 PM, Peterson, Jon = wrote: >=20 >=20 > I agree with that we need to nail this stuff down before we ship the > PASSporT spec. >=20 >> Can we offer any advice to the developer to help them decide when it = is >> necessary to use an alternate set of claims? Also, can we offer any >> advice regarding the properties that are needed to determine if an >> alternate claim set meets the security requirements? For example, >> during the development of STIR we wanted to prevent cut-and-paste >> attacks. >=20 > This is a big one, I think. Pretty much any alternate set of claims = would > need to meet some minimum security bar, like preventing cut-and-paste > attacks. There's a lot of language in RFC4474bis about why we think = the > set of claims baseline PASSporT provides is sufficient for securing = calls. > I think what we need to say here is pretty much that any specification = of > an alternative set of claims needs a similar explanation of what = threats > they prevent and what assurances they provide. >=20 > Otherwise, we could for example end up with an alternative PASSporT = with > one claim - like, just the calling telephone number - which could = easily > be cut-and-pasted by any attacker, and yet a SIP message containing it > would appear valid and secure, even though it offers no protections = beyond > RFC3325, basically. >=20 >> Are there any implications on interoperability for adopting a = different >> set of claims? >=20 > I do worry about "proprietary" one-offs that potentially could create = a > needless interoperability failure. It's better to extend the bare = minimum > when possible than it is do define a completely separate set of base > claims, as even if the recipient of an extended object doesn't = understand > the additional data, it can still use the baseline to validate basic > Identity. Probably, we should only encourage people to adopt an > alternative set of claims that it not a superset of the PASSporT bare > minimum for applications that are genuinely distinct from the = semantics of > placing a telephone call - pretty much anything that looks like a > telephone call will have the same requirements for the called/calling > party numbers (or URIs) and Date. >=20 >> Can we offer any guidance that tells the developer when it would >> be better to start fresh with JOSE JWS instead of trying to adjust >> PASSporT? In other words, where should one try to apply the >> PASSporT framework, and where should one not bother. >=20 > If we only want to reserve alternative claims for use cases that don't > even look like telephone calls, presumably we'd want to say that = PASSporT > is scoped to real-time personal communications, and that for uses that = are > not salient to that, something building on baseline JWS would be more > appropriate? I agree, perhaps we really do need to say that in order to be a PASSporT = token, you must have the base claims, period. I think that is ok for things like GETS and other use-cases we have = talked about, certainly you wouldn=E2=80=99t want to allow or replay = attacks or identity spoofing for these applications. I don=E2=80=99t = believe i can think of another PASSporT relevant/personal communications = case that shouldn=E2=80=99t use the base claim, so maybe for now we just = mandate it. I=E2=80=99m good with that. Plus that i think solves most of Russ=E2=80=99s concerns. Maybe you can look at that as a shortcut, but i suspect we actually did = allow for more flexibility than we really should have. Shall I make the changes? Any examples that anyone can think of that = shouldn=E2=80=99t use the base set of claims? From nobody Tue Jul 5 18:02:44 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5AA5312D559 for ; Tue, 5 Jul 2016 18:02:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.601 X-Spam-Level: X-Spam-Status: No, score=-102.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id z_F1c4mfuELO for ; Tue, 5 Jul 2016 18:02:40 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0b-0018ba01.pphosted.com [67.231.157.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1987F12B025 for ; Tue, 5 Jul 2016 18:02:40 -0700 (PDT) Received: from pps.filterd (m0049401.ppops.net [127.0.0.1]) by m0049401.ppops.net-0018ba01. (8.16.0.17/8.16.0.17) with SMTP id u660rcer008906; Tue, 5 Jul 2016 21:02:37 -0400 Received: from stntexhc10.cis.neustar.com ([156.154.17.216]) by m0049401.ppops.net-0018ba01. with ESMTP id 23x9xa3gs8-1 (version=TLSv1 cipher=AES128-SHA bits=128 verify=NOT); Tue, 05 Jul 2016 21:02:37 -0400 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.94]) by stntexhc10.cis.neustar.com ([169.254.4.225]) with mapi id 14.03.0279.002; Tue, 5 Jul 2016 21:02:36 -0400 From: "Peterson, Jon" To: Chris Wendt Thread-Topic: [stir] Using PASSporT with things other than STIR Thread-Index: AQHRzZPxSpbHwRlIsEOi8lEpAI9J8qAKJjIAgACvfgD//6EBAA== Date: Wed, 6 Jul 2016 01:02:36 +0000 Message-ID: References: <518D00E4-784D-499B-B989-265AFC579F08@brianrosen.net> <7594FB04B1934943A5C02806D1A2204B3802BE3B@ESESSMB209.ericsson.se> <7594FB04B1934943A5C02806D1A2204B3802C104@ESESSMB209.ericsson.se> <01f41eda-4484-e891-bbae-b85eabdf8254@nostrum.com> <2fe6853c-8e83-77d1-e9fc-8848a1387ab9@nostrum.com> <66BCE048-8119-46CF-ACB6-03E5ACEDC8FB@vigilsec.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.6.3.160329 x-originating-ip: [10.96.12.185] Content-Type: text/plain; charset="iso-8859-1" Content-ID: <2382016CE0D9CB43B074BA599CD26A54@neustar.biz> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-07-05_14:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1607060006 Archived-At: Cc: IETF STIR Mail List , Russ Housley Subject: Re: [stir] Using PASSporT with things other than STIR X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 06 Jul 2016 01:02:42 -0000 On 7/5/16, 4:42 PM, "Chris Wendt" wrote: >I agree, perhaps we really do need to say that in order to be a PASSporT >token, you must have the base claims, period. That is the easiest way to deal with it - but we still need to be specific about what "the base claims" are. At first, I think we could have gotten away with saying you need an "otn", "dtn" and "iat". Now that we have "ouri" and "duri" too, as well as the multi-destination claim, our statement of what the "bare minimum" is needs to be a little more versatile while still being specific. We should also remember to future-proof, as future specifications might define new forms of claims for the originator and destination identities to work with new applications. I think the PASSporT text should clarify right up front (either in Section 3, or maybe Section 3.2) that all PASSporTs need at least one claim identifying the originator, and at least one identifying a destination, along with an "iat", to meet the requirements for the base claims. For the most common STIR use case, the first two will be "otn" and "dtn", but we want to leave the door open for other identifiers to fulfill this requirement. We should also add to the text of PASSporT (probably 4.2) a note that any future specifications that define claims need to state in their specifications that if a claim is intended to serve as an originator or a destination for this purpose. >I think that is ok for things like GETS and other use-cases we have >talked about, certainly you wouldn=B9t want to allow or replay attacks or >identity spoofing for these applications. I don=B9t believe i can think o= f >another PASSporT relevant/personal communications case that shouldn=B9t us= e >the base claim, so maybe for now we just mandate it. I agree, if only because the current mechanism requires you to go out and register a new MIME type anyway, and clearly you could do that with or without the blessing of the PASSporT spec. At best, the guidance today is tells you when you might want to go do that, which isn't a bad thing in and of itself, but we could definitely leave any guidance like this to future work rather than doing it right off the bat. Jon Peterson Neustar, Inc. >I=B9m good with that. > >Plus that i think solves most of Russ=B9s concerns. > >Maybe you can look at that as a shortcut, but i suspect we actually did >allow for more flexibility than we really should have. > >Shall I make the changes? Any examples that anyone can think of that >shouldn=B9t use the base set of claims? > > > From nobody Wed Jul 6 06:21:14 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 382E812D0F8 for ; Wed, 6 Jul 2016 06:21:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=chriswendt-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jpnk9h-h5BCR for ; Wed, 6 Jul 2016 06:21:09 -0700 (PDT) Received: from mail-qk0-x231.google.com (mail-qk0-x231.google.com [IPv6:2607:f8b0:400d:c09::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E7F4912D14A for ; Wed, 6 Jul 2016 06:21:03 -0700 (PDT) Received: by mail-qk0-x231.google.com with SMTP id 82so9202922qko.3 for ; Wed, 06 Jul 2016 06:21:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chriswendt-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=WKfLAF9gM7dQUUWesIpx2T066+Dpc7q/Cd2TQ8fFRr8=; b=J5dYlvEoAZX1xfzG1bXlqRZANS6QbzNhzptSvBgOwyq4UmddCHOKXjDI6umYxjrjeS yezfaywuHqA+riDOG2DEwqlUombbrLduQQ+EGScvQkSd1Id6QKTcN9eiJ29kH1/sRZ8S IiqYQAdIunTfIHvbX/QX2/QKM30VVf5RPvsZS2Pc9vO76EzcDDk0m/lOj0R01MzeW/xM CHQIvv/Fm0Mrqr0/ztQg8RnIJ9HlXb5lead46idUCDCTbi/hu/STMi7YHeE7hgS+Sc3F 1xXUNr3A7Kcdqc2V24dRB7obQi3IlOoFtpc2hIvQRpEx/055rQSPzy3iznKp3BHF8acS mRDQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=WKfLAF9gM7dQUUWesIpx2T066+Dpc7q/Cd2TQ8fFRr8=; b=UfRujtYbtz+J8jT8KEQV1KZjYyjDISJZCf1JkMyn3djeuAjEOWYcqrY3r9lz8v4vne esU8rcVrTt2ghdJPKXcoOgMrKurr9f7sbq/z0y+GY+GeL7OMTc6cCVTCdDd2ehF3aRl1 cM2VdhwxnwHMshRif1jHPOT8QQ671WyVhS++4NgEODeB5AWfB6XzzgTI6ENl7sICr6+j lwisd09j+NeEc0Q1o0VijiXmRbsYgaqf8XhdD//IooqYE1hhMj11I9q3LdrHBCl+DGG8 cg7Xby0KFRg7O70HuervyjzBIFrj8u64U3BeYaCGDsGNUWOTpJfx+CCXBWRLyMvVJfQf Yfiw== X-Gm-Message-State: ALyK8tIVGr/8BO3bBh7iZ/gzWDMYqEmCadEAkJ06B2rYRg1lVIX2qB+iyUbhTkZkU1oGTw== X-Received: by 10.55.23.25 with SMTP id i25mr30999520qkh.142.1467811262980; Wed, 06 Jul 2016 06:21:02 -0700 (PDT) Received: from [10.0.2.107] (c-69-247-98-168.hsd1.pa.comcast.net. [69.247.98.168]) by smtp.gmail.com with ESMTPSA id 23sm1209934qty.40.2016.07.06.06.21.02 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 06 Jul 2016 06:21:02 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Chris Wendt In-Reply-To: Date: Wed, 6 Jul 2016 09:21:01 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: <36608244-167F-468D-92D7-CF6FB0AEF7B4@chriswendt.net> References: <518D00E4-784D-499B-B989-265AFC579F08@brianrosen.net> <7594FB04B1934943A5C02806D1A2204B3802BE3B@ESESSMB209.ericsson.se> <7594FB04B1934943A5C02806D1A2204B3802C104@ESESSMB209.ericsson.se> <01f41eda-4484-e891-bbae-b85eabdf8254@nostrum.com> <2fe6853c-8e83-77d1-e9fc-8848a1387ab9@nostrum.com> <66BCE048-8119-46CF-ACB6-03E5ACEDC8FB@vigilsec.com> To: "Peterson, Jon" X-Mailer: Apple Mail (2.3124) Archived-At: Cc: IETF STIR Mail List , Russ Housley Subject: Re: [stir] Using PASSporT with things other than STIR X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 06 Jul 2016 13:21:11 -0000 > On Jul 5, 2016, at 9:02 PM, Peterson, Jon = wrote: >=20 >=20 >=20 > On 7/5/16, 4:42 PM, "Chris Wendt" wrote: >=20 >> I agree, perhaps we really do need to say that in order to be a = PASSporT >> token, you must have the base claims, period. >=20 > That is the easiest way to deal with it - but we still need to be = specific > about what "the base claims" are. At first, I think we could have = gotten > away with saying you need an "otn", "dtn" and "iat". Now that we have > "ouri" and "duri" too, as well as the multi-destination claim, our > statement of what the "bare minimum" is needs to be a little more > versatile while still being specific. We should also remember to > future-proof, as future specifications might define new forms of = claims > for the originator and destination identities to work with new > applications. >=20 > I think the PASSporT text should clarify right up front (either in = Section > 3, or maybe Section 3.2) that all PASSporTs need at least one claim > identifying the originator, and at least one identifying a = destination, > along with an "iat", to meet the requirements for the base claims. For = the > most common STIR use case, the first two will be "otn" and "dtn", but = we > want to leave the door open for other identifiers to fulfill this > requirement. >=20 > We should also add to the text of PASSporT (probably 4.2) a note that = any > future specifications that define claims need to state in their > specifications that if a claim is intended to serve as an originator = or a > destination for this purpose. Fair enough, totally agree, i will work that into the text. >=20 >> I think that is ok for things like GETS and other use-cases we have >> talked about, certainly you wouldn=C4=85t want to allow or replay = attacks or >> identity spoofing for these applications. I don=C4=85t believe i can = think of >> another PASSporT relevant/personal communications case that = shouldn=C4=85t use >> the base claim, so maybe for now we just mandate it. >=20 > I agree, if only because the current mechanism requires you to go out = and > register a new MIME type anyway, and clearly you could do that with or > without the blessing of the PASSporT spec. At best, the guidance today = is > tells you when you might want to go do that, which isn't a bad thing = in > and of itself, but we could definitely leave any guidance like this to > future work rather than doing it right off the bat. >=20 > Jon Peterson > Neustar, Inc. >=20 >> I=C4=85m good with that. >>=20 >> Plus that i think solves most of Russ=C4=85s concerns. >>=20 >> Maybe you can look at that as a shortcut, but i suspect we actually = did >> allow for more flexibility than we really should have. >>=20 >> Shall I make the changes? Any examples that anyone can think of that >> shouldn=C4=85t use the base set of claims? >>=20 >>=20 >>=20 >=20 From nobody Wed Jul 6 21:20:50 2016 Return-Path: X-Original-To: stir@ietf.org Delivered-To: stir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 70D5D12D0BE; Wed, 6 Jul 2016 21:20:49 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.25.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20160707042049.26736.35696.idtracker@ietfa.amsl.com> Date: Wed, 06 Jul 2016 21:20:49 -0700 Archived-At: Cc: stir@ietf.org Subject: [stir] I-D Action: draft-ietf-stir-certificates-06.txt X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Jul 2016 04:20:49 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Secure Telephone Identity Revisited of the IETF. Title : Secure Telephone Identity Credentials: Certificates Authors : Jon Peterson Sean Turner Filename : draft-ietf-stir-certificates-06.txt Pages : 21 Date : 2016-07-06 Abstract: In order to prevent the impersonation of telephone numbers on the Internet, some kind of credential system needs to exist that cryptographically proves authority over telephone numbers. This document describes the use of certificates in establishing authority over telephone numbers, as a component of a broader architecture for managing telephone numbers as identities in protocols like SIP. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-stir-certificates/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-stir-certificates-06 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-stir-certificates-06 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Wed Jul 6 21:24:24 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CE1EF12B00B for ; Wed, 6 Jul 2016 21:24:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Rz4PIrV1tuKk for ; Wed, 6 Jul 2016 21:24:20 -0700 (PDT) Received: from mail-qk0-x22c.google.com (mail-qk0-x22c.google.com [IPv6:2607:f8b0:400d:c09::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 63A9A128E19 for ; Wed, 6 Jul 2016 21:24:20 -0700 (PDT) Received: by mail-qk0-x22c.google.com with SMTP id t127so5398476qkf.1 for ; Wed, 06 Jul 2016 21:24:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=mime-version:subject:from:in-reply-to:date :content-transfer-encoding:message-id:references:to; bh=/nAypLD5gw81TchEXR5AsdEGK6bUtath7PaflaFu5vE=; b=BYDTY/W94Aed05rc+WCe2rPjLiAF+2Amk0VXhJ4ah8MRwY4i7JC5tEp71P/B39ZoTY 6btgonN1Gn8G55BlkP0yC+DCQ4V6WLtOByN9yyWm1OOR7jFKydL4LfF5crz/ELL1LVgx /LoLv+qxgsEmeK+gYeCL5GBD8hivX6IK+hhkE= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date :content-transfer-encoding:message-id:references:to; bh=/nAypLD5gw81TchEXR5AsdEGK6bUtath7PaflaFu5vE=; b=lPCzNYClX2a9KCkkw4HFjdIfAwFhj6ejieXAPEHSxdgX21knxDdqA+KlmTgi2/4RGx /Rrv0hPoNWHkgDzavKfe2qxrUKrEOG9SHu3jE0WPcGj7gpFWSpl/PmVqcmlF4j1dqhvT unF/tbRABj0fKnEFReCgUcx0LzXHTRfg9PNLOTEr7whKy6zoHyd6ATgKGonWVvGWbVdF P/9I4edwkkHmHU/UNaghOt3fqzkdcD0qNz+QjgOyR+jzTRnQkzKHZq7Sa7lT5IdUMBrq 0uflp3fGw3q2G56WEwxNJJv5BOAZfx93sBx7hrxc7xd8QZWpdSF1NyA796I88bNcvk3i uuOQ== X-Gm-Message-State: ALyK8tJ7fHUipaiKqas2vsMYsSp8Nzl1DuNoRgcSlBuBXcsAOYeVHrXa81JCA6nAFCUBOQ== X-Received: by 10.55.53.4 with SMTP id c4mr29726089qka.92.1467865459257; Wed, 06 Jul 2016 21:24:19 -0700 (PDT) Received: from [172.16.0.112] ([96.231.230.69]) by smtp.gmail.com with ESMTPSA id 1sm2100331qtv.13.2016.07.06.21.24.18 for (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 06 Jul 2016 21:24:18 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Sean Turner In-Reply-To: <20160707042049.26736.35696.idtracker@ietfa.amsl.com> Date: Thu, 7 Jul 2016 00:24:17 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: <95A0D3E3-7BAD-4FF9-981B-3B23EFB6EC62@sn3rd.com> References: <20160707042049.26736.35696.idtracker@ietfa.amsl.com> To: stir@ietf.org X-Mailer: Apple Mail (2.3124) Archived-At: Subject: Re: [stir] I-D Action: draft-ietf-stir-certificates-06.txt X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Jul 2016 04:24:23 -0000 Hi, This version incorporates text to address: 0. Levels Of Assurance There was a TBD in s5. I removed the TBD and added some text explaining = how LOA is conveyed as OIDs in certificate's certificate policies = extensions. I threw in some additional wording about how OIDs represent = the certification policies and those as well as the certification = practice statements (CPSs) are just part of the normal PKI = =E2=80=9Cprocess=E2=80=9D. I decided to co-opt the LOA profiles defined in RFC 6711. I requires a = SAML Context, but the RFC says non-SAML registrations are accepted. So, = I created sub-registry and instead of a SAML Context you submit your = OID. I included that the expert is expect to ensure that the OID is in = the CP. I almost added =E2=80=9Cand nothing else, but that=E2=80=99s = maybe too much. We could also get a couple of volunteers to be experts = and the STIR-related registries could be farmed to them. 1. Profiling OCSP We=E2=80=99ve got OCSP, we=E2=80=99ve got it's High-Volume Environment = (HVE) profile, we=E2=80=99ve got an extension, we=E2=80=99ve got ECDSA = P-256 with SHA-256 signatures. Unfortunately, these all don=E2=80=99t = go together so we had to do some profiling. Most of it=E2=80=99s pretty = straightforward, but a couple of things I wanted to note: 1.a. draft-ietf-stir-certificates purposely DO NOT update the OCSP or = HVE profiles because we=E2=80=99re not trying to say that all OCSP and = HVE implementations MUST do what we=E2=80=99re specifying here. = Basically, the STIR profile is not for everybody. 1.b. OCSP has two places to extend requests/responses: one is per = request/response and the other allows you to apply an extension to = multiple requests/responses. I think we=E2=80=99re not looking at = grouping reqeusts/responses so I switched the location of the extensions = from requestExtensions/responseExtensions to request=E2=80=99s = singleResponseExtension/responses=E2=80=99 singleExtension. 1.c. As we discussed on the interim call, we need to return =E2=80=9Cnot = good=E2=80=9D when the status is =E2=80=9Cunknown=E2=80=9D. I made the = server a SHOULD send =E2=80=9Cnot good=E2=80=9D only, and clients a MUST = treat =E2=80=9Cunknown=E2=80=9D as =E2=80=9Cnot good=E2=80=9D. 1.d. The OCSP requires RSA with SHA-256 so we=E2=80=99re good there, but = I had to mandate support for ECDSA using P-256 and SHA-256. 1.e. I=E2=80=99m proposing that we embrace SHA-256 for every hash. = Because the HVE profile requires SHA-1 for the hash values used to = identify the issuer=E2=80=99s certificate and name and OCSP itself bakes = SHA-1 into the optional ResponderId.KeyHash (the other choice is Name = but HVE recommends KeyHash be used) I had to add some statements about = SHA-256. I=E2=80=99m thinking this for two reasons: 1) we=E2=80=99re = using SHA-256 with our signatures so why have this code to generate = these values reuse SHA-256, and 2) I suspect that some (likely Gov=E2=80=99= t) weenie is going to ask in the not too distant future =E2=80=9Cdoes = you product use SHA-1=E2=80=9D and if you tick yes you=E2=80=99re going = to have explain why (saying on here is probably worth it). Comments welcome. spt > On Jul 07, 2016, at 00:20, internet-drafts@ietf.org wrote: >=20 >=20 > A New Internet-Draft is available from the on-line Internet-Drafts = directories. > This draft is a work item of the Secure Telephone Identity Revisited = of the IETF. >=20 > Title : Secure Telephone Identity Credentials: = Certificates > Authors : Jon Peterson > Sean Turner > Filename : draft-ietf-stir-certificates-06.txt > Pages : 21 > Date : 2016-07-06 >=20 > Abstract: > In order to prevent the impersonation of telephone numbers on the > Internet, some kind of credential system needs to exist that > cryptographically proves authority over telephone numbers. This > document describes the use of certificates in establishing authority > over telephone numbers, as a component of a broader architecture for > managing telephone numbers as identities in protocols like SIP. >=20 >=20 > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-stir-certificates/ >=20 > There's also a htmlized version available at: > https://tools.ietf.org/html/draft-ietf-stir-certificates-06 >=20 > A diff from the previous version is available at: > https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-stir-certificates-06 >=20 >=20 > Please note that it may take a couple of minutes from the time of = submission > until the htmlized version and diff are available at tools.ietf.org. >=20 > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir From nobody Thu Jul 7 15:00:14 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9CE1412D8D3 for ; Thu, 7 Jul 2016 15:00:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.326 X-Spam-Level: X-Spam-Status: No, score=-3.326 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-1.426] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id l1Cr1lgQ50jp for ; Thu, 7 Jul 2016 15:00:11 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4E48D12D8D5 for ; Thu, 7 Jul 2016 15:00:10 -0700 (PDT) Received: from unnumerable.local ([173.57.161.14]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id u67LgufO046317 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=OK) for ; Thu, 7 Jul 2016 16:42:56 -0500 (CDT) (envelope-from rjsparks@nostrum.com) X-Authentication-Warning: raven.nostrum.com: Host [173.57.161.14] claimed to be unnumerable.local From: Robert Sparks To: stir@ietf.org Message-ID: <938dfbb7-3437-8fa8-4194-245abb4ae18c@nostrum.com> Date: Thu, 7 Jul 2016 16:42:56 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.1.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: [stir] Registration for SIPIt 32 is open X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Jul 2016 22:00:12 -0000 The SIP Forum's SIPit 32 will be held at the University of New Hampshire Interoperability Laboratory September 12-16, 2016. In addition to the usual thorough testing, we expect this event to focus on new evolutions in SIP Security such as the mechanisms defined in the STIR working group. We also hope to inform the new SIPBRANDY effort in the IETF. More information about the SIPit is available at https://www.sipit.net. Registration is open at https://www.regonline.com/sipit32 RjS From nobody Fri Jul 8 13:52:55 2016 Return-Path: X-Original-To: stir@ietf.org Delivered-To: stir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 15C6412D638; Fri, 8 Jul 2016 13:52:50 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.25.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20160708205250.32139.86234.idtracker@ietfa.amsl.com> Date: Fri, 08 Jul 2016 13:52:50 -0700 Archived-At: Cc: stir@ietf.org Subject: [stir] I-D Action: draft-ietf-stir-certificates-07.txt X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Jul 2016 20:52:50 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Secure Telephone Identity Revisited of the IETF. Title : Secure Telephone Identity Credentials: Certificates Authors : Jon Peterson Sean Turner Filename : draft-ietf-stir-certificates-07.txt Pages : 22 Date : 2016-07-08 Abstract: In order to prevent the impersonation of telephone numbers on the Internet, some kind of credential system needs to exist that cryptographically proves authority over telephone numbers. This document describes the use of certificates in establishing authority over telephone numbers, as a component of a broader architecture for managing telephone numbers as identities in protocols like SIP. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-stir-certificates/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-stir-certificates-07 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-stir-certificates-07 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Fri Jul 8 14:16:49 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CE2DF12D607 for ; Fri, 8 Jul 2016 14:16:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BjSgHUHHjoVW for ; Fri, 8 Jul 2016 14:16:42 -0700 (PDT) Received: from mail-qk0-x234.google.com (mail-qk0-x234.google.com [IPv6:2607:f8b0:400d:c09::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C930B12D56E for ; Fri, 8 Jul 2016 14:16:41 -0700 (PDT) Received: by mail-qk0-x234.google.com with SMTP id p74so13554722qka.0 for ; Fri, 08 Jul 2016 14:16:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=mime-version:subject:from:in-reply-to:date :content-transfer-encoding:message-id:references:to; bh=/r+AhbcvMSNzzMrY5O+2X2FWLFDp29rQFJNRVFEtbV0=; b=PJXVq9z4k8wpsf8in9QLHGlQhOPUzBiFNA1P+buI5GkAx+0szj8aIpqkdbFP1ZlhP6 ZEWYvyWyqw5wXHm+6cLD1lGcU5F9wD/o8lUCqaQMR08iijDEAttY97pVVME03aficMso fwFraLu/aLsrchYtPGg6jy4ZY40AYOjNbmUEs= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date :content-transfer-encoding:message-id:references:to; bh=/r+AhbcvMSNzzMrY5O+2X2FWLFDp29rQFJNRVFEtbV0=; b=UWBN9S5GHnifkmZ+aMSQk6Zi9vV4RPpGEph1RAMTEBJoaNnrL/1weEBrYog3GOvOpm N4AsxLk16gfnmD8Wmd/avpjo5ACiYGgUiEvVbt2srZE0TUfKwrmUYLgW7AQpnw8lX9Uf YMHjSt2yP2vaOshUWtubBIdQ++6CLeYopRN9K7CUbRKXMdNeLffBqn1RA8CXEUNQ7rGH bPF4vw2xajJTXSAGm//3jJnLBopzuoS8Iayr/Plo6QqTox5om1OlRwr8EaJ2aPfn/xaj IcPAdvhcfQOl2gCvrv0u0r5JPr2ymR5L1r836fwWVUJrEnn6gtmXOUcx8BVp60G8XpCN jx+g== X-Gm-Message-State: ALyK8tIXbn1eElDwhK0dhbJO44dnrewS+HDG33lpjf4QluqfjQcDOCQ1oabF5xzWjeeFjw== X-Received: by 10.55.168.137 with SMTP id r131mr10581070qke.24.1468012600740; Fri, 08 Jul 2016 14:16:40 -0700 (PDT) Received: from [172.16.0.112] ([96.231.230.69]) by smtp.gmail.com with ESMTPSA id d85sm2336350qkg.47.2016.07.08.14.16.39 for (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Fri, 08 Jul 2016 14:16:40 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Sean Turner In-Reply-To: <20160708205250.32139.86234.idtracker@ietfa.amsl.com> Date: Fri, 8 Jul 2016 17:16:38 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: <73FC919F-DB3B-403E-87CD-E91E8391C88E@sn3rd.com> References: <20160708205250.32139.86234.idtracker@ietfa.amsl.com> To: stir@ietf.org X-Mailer: Apple Mail (2.3124) Archived-At: Subject: Re: [stir] I-D Action: draft-ietf-stir-certificates-07.txt X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Jul 2016 21:16:47 -0000 This version incorporates the WG decision to support both RSA and ECDSA = on verify. I=E2=80=99d not included that in the previous version. It = seemed prudent to require that the same algorithm be used on OCSP = responses and any CRL and the certificate being checked. As I=E2=80=99m proposing to go all in on SHA-256 I missed the AKI/SKI = use and added that in. I also figured that instead of having certificate-related requirements = scattered about the draft I=E2=80=99d included a point from s4 to where = the requirements are but leave them in the other sections so you=E2=80=99v= e got context for the requirement. Oh and I made the LOA discussion it=E2=80=99s own section. As before, comments welcome. But, I think this one is ready for WGLC. spt > On Jul 08, 2016, at 16:52, internet-drafts@ietf.org wrote: >=20 >=20 > A New Internet-Draft is available from the on-line Internet-Drafts = directories. > This draft is a work item of the Secure Telephone Identity Revisited = of the IETF. >=20 > Title : Secure Telephone Identity Credentials: = Certificates > Authors : Jon Peterson > Sean Turner > Filename : draft-ietf-stir-certificates-07.txt > Pages : 22 > Date : 2016-07-08 >=20 > Abstract: > In order to prevent the impersonation of telephone numbers on the > Internet, some kind of credential system needs to exist that > cryptographically proves authority over telephone numbers. This > document describes the use of certificates in establishing authority > over telephone numbers, as a component of a broader architecture for > managing telephone numbers as identities in protocols like SIP. >=20 >=20 > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-stir-certificates/ >=20 > There's also a htmlized version available at: > https://tools.ietf.org/html/draft-ietf-stir-certificates-07 >=20 > A diff from the previous version is available at: > https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-stir-certificates-07 >=20 >=20 > Please note that it may take a couple of minutes from the time of = submission > until the htmlized version and diff are available at tools.ietf.org. >=20 > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ >=20 > _______________________________________________ > I-D-Announce mailing list > I-D-Announce@ietf.org > https://www.ietf.org/mailman/listinfo/i-d-announce > Internet-Draft directories: http://www.ietf.org/shadow.html > or ftp://ftp.ietf.org/ietf/1shadow-sites.txt From nobody Fri Jul 8 14:40:26 2016 Return-Path: X-Original-To: stir@ietf.org Delivered-To: stir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 6D50312D623; Fri, 8 Jul 2016 14:40:23 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.25.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20160708214023.32160.68379.idtracker@ietfa.amsl.com> Date: Fri, 08 Jul 2016 14:40:23 -0700 Archived-At: Cc: stir@ietf.org Subject: [stir] I-D Action: draft-ietf-stir-rfc4474bis-10.txt X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Jul 2016 21:40:23 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Secure Telephone Identity Revisited of the IETF. Title : Authenticated Identity Management in the Session Initiation Protocol (SIP) Authors : Jon Peterson Cullen Jennings Eric Rescorla Chris Wendt Filename : draft-ietf-stir-rfc4474bis-10.txt Pages : 40 Date : 2016-07-08 Abstract: The baseline security mechanisms in the Session Initiation Protocol (SIP) are inadequate for cryptographically assuring the identity of the end users that originate SIP requests, especially in an interdomain context. This document defines a mechanism for securely identifying originators of SIP requests. It does so by defining a SIP header field for conveying a signature used for validating the identity, and for conveying a reference to the credentials of the signer. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-stir-rfc4474bis/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-stir-rfc4474bis-10 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-stir-rfc4474bis-10 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Fri Jul 8 16:12:14 2016 Return-Path: X-Original-To: stir@ietf.org Delivered-To: stir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 8E14F12D14D; Fri, 8 Jul 2016 16:12:12 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.25.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20160708231212.32160.85179.idtracker@ietfa.amsl.com> Date: Fri, 08 Jul 2016 16:12:12 -0700 Archived-At: Cc: stir@ietf.org Subject: [stir] I-D Action: draft-ietf-stir-passport-04.txt X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Jul 2016 23:12:12 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Secure Telephone Identity Revisited of the IETF. Title : Persona Assertion Token Authors : Chris Wendt Jon Peterson Filename : draft-ietf-stir-passport-04.txt Pages : 17 Date : 2016-07-08 Abstract: This document defines a token format for verifying with non- repudiation the sender of and authorization to send information related to the originator of personal communications. A cryptographic signature is defined to protect the integrity of the information used to identify the originator of a personal communications session (e.g. the telephone number or URI) and verify the accuracy of this information at the destination. The cryptographic signature is defined with the intention that it can confidently verify the originating persona even when the signature is sent to the destination party over an unsecure channel. The Persona Assertion Token (PASSporT) is particularly useful for many personal communications applications over IP networks and other multi-hop interconnection scenarios where the originating and destination parties may not have a direct trusted relationship. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-stir-passport/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-stir-passport-04 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-stir-passport-04 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Fri Jul 8 16:22:23 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 03AB712D960 for ; Fri, 8 Jul 2016 16:22:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.6 X-Spam-Level: X-Spam-Status: No, score=-102.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B2LfYpjZMWld for ; Fri, 8 Jul 2016 16:22:20 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0b-0018ba01.pphosted.com [67.231.157.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7B98712D100 for ; Fri, 8 Jul 2016 16:22:20 -0700 (PDT) Received: from pps.filterd (m0078668.ppops.net [127.0.0.1]) by mx0b-0018ba01.pphosted.com (8.16.0.17/8.16.0.17) with SMTP id u68NDIPs000691 for ; Fri, 8 Jul 2016 19:17:14 -0400 Received: from stntexhc12.cis.neustar.com ([156.154.17.216]) by mx0b-0018ba01.pphosted.com with ESMTP id 2425d324p5-1 (version=TLSv1 cipher=AES128-SHA bits=128 verify=NOT) for ; Fri, 08 Jul 2016 19:17:13 -0400 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.94]) by stntexhc12.cis.neustar.com ([::1]) with mapi id 14.03.0279.002; Fri, 8 Jul 2016 19:17:13 -0400 From: "Peterson, Jon" To: IETF STIR Mail List Thread-Topic: a syntax change Thread-Index: AQHR2W7bzsTobHl6sEOOeZEJkt6dxg== Date: Fri, 8 Jul 2016 23:17:12 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.6.3.160329 x-originating-ip: [10.96.12.104] Content-Type: multipart/alternative; boundary="_000_D3A582891A58E7jonpetersonneustarbiz_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-07-08_13:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1607080229 Archived-At: Subject: [stir] a syntax change X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Jul 2016 23:22:22 -0000 --_000_D3A582891A58E7jonpetersonneustarbiz_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Attentive readers will observed a syntax change in passport-04 which carrie= s over to rfc4744bis-10. Implementers, especially those looking forward to = the SIPit coming up, should take note. The change is to the claims of the PASSporT object. Rather than having two = different versions of each claim to reflect the originating and destination= side, such as "otn" and "dtn", there is now simply a "tn" claim. That clai= m will appear within a JSON array explicitly labeled as "orig" or "dest" in= the PASSporT object. This will result in PASSporT claims like the following: { "orig":{"tn":"12155551212"}, "dest":{"tn":"12155551213"}, "iat":"1443208345" } The "dest" claim is specifically defined to allow one or more values, so it= replaces the previous "dgrp" claim to be used in cases where a message has= multiple destinations. This eliminated the redundancy of having future extensions to the PASSporT = claims identify whether they carried an identifier for the originating or d= estination side. Now, new claim definitions simply have to state that they = contain identifiers: the semantics of the identifier will depend on whether= it appears under "orig" or "dest". In fact, PASSporT could probably work w= ith some existing JWT claims now that represent identifiers. This seemed li= ke a much better idea than the way we were doing it before. This was a fairly last-minute fix, but it didn't require much spec change a= nd is hopefully stable and consistent. Thoughts welcome. Jon Peterson Neustar, Inc. --_000_D3A582891A58E7jonpetersonneustarbiz_ Content-Type: text/html; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable

Attentive readers will observed a syntax change in passport-04 which c= arries over to rfc4744bis-10. Implementers, especially those looking forwar= d to the SIPit coming up, should take note.

The change is to the claims of the PASSporT object. Rather than having= two different versions of each claim to reflect the originating and destin= ation side, such as "otn" and "dtn", there is now simpl= y a "tn" claim. That claim will appear within a JSON array explicitly labeled as "orig" or "dest" in the PA= SSporT object. 

This will result in PASSporT claims like the following:

      { "ori=
g":{"tn":"12155551212"},
        "dest":{"tn":"12155551213"},
        "iat":"1443208345" }

The "dest" claim is specifically defined to allow one or mor= e values, so it replaces the previous "dgrp" claim to be used in = cases where a message has multiple destinations.

This eliminated the redundancy of having future extensions to the PASS= porT claims identify whether they carried an identifier for the originating= or destination side. Now, new claim definitions simply have to state that = they contain identifiers: the semantics of the identifier will depend on whether it appears under "orig"= or "dest". In fact, PASSporT could probably work with some exist= ing JWT claims now that represent identifiers. This seemed like a much bett= er idea than the way we were doing it before.

This was a fairly last-minute fix, but it didn't require much spec cha= nge and is hopefully stable and consistent. Thoughts welcome.

Jon Peterson
Neustar, Inc.


--_000_D3A582891A58E7jonpetersonneustarbiz_-- From nobody Sun Jul 10 20:02:07 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BBCBF12B01B for ; Sun, 10 Jul 2016 20:02:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.253 X-Spam-Level: X-Spam-Status: No, score=-1.253 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_BL_SPAMCOP_NET=1.347, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H2=-0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gS--BzhmAIET for ; Sun, 10 Jul 2016 20:02:04 -0700 (PDT) Received: from atl4mhob19.myregisteredsite.com (atl4mhob19.myregisteredsite.com [209.17.115.112]) by ietfa.amsl.com (Postfix) with ESMTP id 6599C128B44 for ; Sun, 10 Jul 2016 20:02:04 -0700 (PDT) Received: from mailpod.hostingplatform.com ([10.30.71.205]) by atl4mhob19.myregisteredsite.com (8.14.4/8.14.4) with ESMTP id u6B322Vu006105 for ; Sun, 10 Jul 2016 23:02:02 -0400 Received: (qmail 3420 invoked by uid 0); 11 Jul 2016 03:02:02 -0000 X-TCPREMOTEIP: 114.252.56.235 X-Authenticated-UID: di-shi@transnexus.com Received: from unknown (HELO I620) (di-shi@transnexus.com@114.252.56.235) by 0 with ESMTPA; 11 Jul 2016 03:02:01 -0000 From: "Di-Shi Sun" To: "'Peterson, Jon'" , "'IETF STIR Mail List'" References: In-Reply-To: Date: Mon, 11 Jul 2016 11:01:59 +0800 Organization: TransNexus, Inc. Message-ID: <000001d1db20$99828800$cc879800$@transnexus.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0001_01D1DB63.A7AB9460" X-Mailer: Microsoft Outlook 14.0 Thread-Index: AQJ0EZvzo3Z5kEnV3U6IsqCZBiasWZ7OFcww Content-Language: en-us Archived-At: Subject: Re: [stir] a syntax change X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: di-shi@transnexus.com List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Jul 2016 03:02:05 -0000 This is a multipart message in MIME format. ------=_NextPart_000_0001_01D1DB63.A7AB9460 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Does the example in draft-ietf-stir-passport-04 satisfy JSON rules? There are two uri in dest but they are not array. { "iat":"1443208345", "orig":{ "tn":"12155551212" }, "dest":{ "uri":"sip:alice@example.com", "tn":"12125551212", "uri":"sip:bob@example.net" } } Thanks, Di-Shi Sun. From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Peterson, Jon Sent: Saturday, July 09, 2016 7:17 AM To: IETF STIR Mail List Subject: [stir] a syntax change Attentive readers will observed a syntax change in passport-04 which carries over to rfc4744bis-10. Implementers, especially those looking forward to the SIPit coming up, should take note. The change is to the claims of the PASSporT object. Rather than having two different versions of each claim to reflect the originating and destination side, such as "otn" and "dtn", there is now simply a "tn" claim. That claim will appear within a JSON array explicitly labeled as "orig" or "dest" in the PASSporT object. This will result in PASSporT claims like the following: { "orig":{"tn":"12155551212"}, "dest":{"tn":"12155551213"}, "iat":"1443208345" } The "dest" claim is specifically defined to allow one or more values, so it replaces the previous "dgrp" claim to be used in cases where a message has multiple destinations. This eliminated the redundancy of having future extensions to the PASSporT claims identify whether they carried an identifier for the originating or destination side. Now, new claim definitions simply have to state that they contain identifiers: the semantics of the identifier will depend on whether it appears under "orig" or "dest". In fact, PASSporT could probably work with some existing JWT claims now that represent identifiers. This seemed like a much better idea than the way we were doing it before. This was a fairly last-minute fix, but it didn't require much spec change and is hopefully stable and consistent. Thoughts welcome. Jon Peterson Neustar, Inc. ------=_NextPart_000_0001_01D1DB63.A7AB9460 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Does the example in draft-ietf-stir-passport-04 satisfy JSON rules? = There are two uri in dest but they are not = array.

 

{

           &nbs= p;    = "iat":"1443208345",

           &nbs= p;    "orig":{

           &nbs= p;            = ;        = "tn":"12155551212"

           &nbs= p;    },

           &nbs= p;    "dest":{

           &nbs= p;            = ;        = "uri":"sip:alice@example.com",

<= p class=3DMsoNormal>           &nbs= p;            = ;        = "tn":"12125551212",

           &nbs= p;            = ;        = "uri":"sip:bob@example.net"

           &nbs= p;    }

}

 

Thanks,

 

Di-Shi Sun.

From:= = stir [mailto:stir-bounces@ietf.org] On Behalf Of Peterson, = Jon
Sent: Saturday, July 09, 2016 7:17 AM
To: IETF = STIR Mail List
Subject: [stir] a syntax = change

 

 

Attentive readers will observed a syntax change in passport-04 which = carries over to rfc4744bis-10. Implementers, especially those looking = forward to the SIPit coming up, should take = note.

 

The change is to the claims of the PASSporT object. Rather than having = two different versions of each claim to reflect the originating and = destination side, such as "otn" and "dtn", there is = now simply a "tn" claim. That claim will appear within a JSON = array explicitly labeled as "orig" or "dest" in the = PASSporT object. 

 

This will result in PASSporT claims like the = following:

 

      { =
"orig":{"tn":"12155551212"},
        =
"dest":{"tn":"12155551213"},
        =
"iat":"1443208345" =
}

 

The "dest" claim is specifically defined to allow one or more = values, so it replaces the previous "dgrp" claim to be used in = cases where a message has multiple = destinations.

 

This eliminated the redundancy of having future extensions to the = PASSporT claims identify whether they carried an identifier for the = originating or destination side. Now, new claim definitions simply have = to state that they contain identifiers: the semantics of the identifier = will depend on whether it appears under "orig" or = "dest". In fact, PASSporT could probably work with some = existing JWT claims now that represent identifiers. This seemed like a = much better idea than the way we were doing it = before.

 

This was a fairly last-minute fix, but it didn't require much spec = change and is hopefully stable and consistent. Thoughts = welcome.

 

Jon Peterson

Neustar, Inc.

 

 

------=_NextPart_000_0001_01D1DB63.A7AB9460-- From nobody Mon Jul 11 06:13:23 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3576712D0BB for ; Mon, 11 Jul 2016 06:13:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.22 X-Spam-Level: X-Spam-Status: No, score=-4.22 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ypAds-_LoYm4 for ; Mon, 11 Jul 2016 06:13:20 -0700 (PDT) Received: from sesbmg22.ericsson.net (sesbmg22.ericsson.net [193.180.251.48]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E00BD12D0B9 for ; Mon, 11 Jul 2016 06:13:19 -0700 (PDT) X-AuditID: c1b4fb30-f79486d0000069d0-33-57839b6ec5e0 Received: from ESESSHC013.ericsson.se (Unknown_Domain [153.88.183.57]) by sesbmg22.ericsson.net (Symantec Mail Security) with SMTP id BE.65.27088.E6B93875; Mon, 11 Jul 2016 15:13:18 +0200 (CEST) Received: from ESESSMB208.ericsson.se ([169.254.8.19]) by ESESSHC013.ericsson.se ([153.88.183.57]) with mapi id 14.03.0294.000; Mon, 11 Jul 2016 15:13:17 +0200 From: Christer Holmberg To: "Peterson, Jon" , IETF STIR Mail List Thread-Topic: a syntax change Thread-Index: AQHR2W7bzsTobHl6sEOOeZEJkt6dxqATONnw Date: Mon, 11 Jul 2016 13:13:17 +0000 Message-ID: <7594FB04B1934943A5C02806D1A2204B476855E5@ESESSMB208.ericsson.se> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [153.88.183.150] Content-Type: multipart/alternative; boundary="_000_7594FB04B1934943A5C02806D1A2204B476855E5ESESSMB208erics_" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprAIsWRmVeSWpSXmKPExsUyM2K7pW7e7OZwg28HBC3ONFhaLF+7jcmB yWPJkp9MHjsanjMHMEVx2aSk5mSWpRbp2yVwZWx8X12wMa5i7xv1BsZXwV2MnBwSAiYSKzc/ YIOwxSQu3FsPZHNxCAkcYZR4evsAK4SzmFHiz4zPjF2MHBxsAhYS3f+0QRpEBEIlJnVMZwSx hQVkJCavOMAGEZeVmDPvChOEbSSxe91nMJtFQFXiwpwOMJtXwFdiz5qrYL1CAmYS7aeWsIGM 5xQwl5h7RRkkzAh0z/dTa8DKmQXEJW49mc8EcaeAxJI955khbFGJl4//sULYShIrtl9ihKjP l9jSe5cdYpWgxMmZT1gmMIrMQjJqFpKyWUjKIOI6Egt2f2KDsLUlli18zQxjnznwmAlZfAEj +ypG0eLU4qTcdCMjvdSizOTi4vw8vbzUkk2MwHg6uOW3wQ7Gl88dDzEKcDAq8fAmHG0KF2JN LCuuzD3EKMHBrCTCqze1OVyINyWxsiq1KD++qDQntfgQozQHi5I4r/9LxXAhgfTEktTs1NSC 1CKYLBMHp1QDY/dXXVUdaTnvWf9SbYxDTgqp/Qr6ISQqspChQD19ceKzCUc+BF9/eUZJzivk na/ktXdnZsb++m9zdGf9Gg0lDktjwY8MvjWn+nvmys9rFDGxU9928xgH882vGrJfuG/5qRtu O/skmvu3cPwa57cJzfM8bNo2/y9SusPBt7z5cOG5LXKpb11ClViKMxINtZiLihMBwm0XDKMC AAA= Archived-At: Subject: Re: [stir] a syntax change X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Jul 2016 13:13:22 -0000 --_000_7594FB04B1934943A5C02806D1A2204B476855E5ESESSMB208erics_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi, Some time ago there was a discussion whether we should include the claims t= o begin with, as the information can be retrieved from other SIP informatio= n elements. Did we make a conclusion on that? Regards, Christer From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Peterson, Jon Sent: 09 July 2016 02:17 To: IETF STIR Mail List Subject: [stir] a syntax change Attentive readers will observed a syntax change in passport-04 which carrie= s over to rfc4744bis-10. Implementers, especially those looking forward to = the SIPit coming up, should take note. The change is to the claims of the PASSporT object. Rather than having two = different versions of each claim to reflect the originating and destination= side, such as "otn" and "dtn", there is now simply a "tn" claim. That clai= m will appear within a JSON array explicitly labeled as "orig" or "dest" in= the PASSporT object. This will result in PASSporT claims like the following: { "orig":{"tn":"12155551212"}, "dest":{"tn":"12155551213"}, "iat":"1443208345" } The "dest" claim is specifically defined to allow one or more values, so it= replaces the previous "dgrp" claim to be used in cases where a message has= multiple destinations. This eliminated the redundancy of having future extensions to the PASSporT = claims identify whether they carried an identifier for the originating or d= estination side. Now, new claim definitions simply have to state that they = contain identifiers: the semantics of the identifier will depend on whether= it appears under "orig" or "dest". In fact, PASSporT could probably work w= ith some existing JWT claims now that represent identifiers. This seemed li= ke a much better idea than the way we were doing it before. This was a fairly last-minute fix, but it didn't require much spec change a= nd is hopefully stable and consistent. Thoughts welcome. Jon Peterson Neustar, Inc. --_000_7594FB04B1934943A5C02806D1A2204B476855E5ESESSMB208erics_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi,

 = ;

Some time = ago there was a discussion whether we should include the claims to begin wi= th, as the information can be retrieved from other SIP information elements.

 = ;

Did we mak= e a conclusion on that?

 = ;

Regards,

 = ;

Christer

 

From: = stir [mailto:stir-bounces@ietf.org] On Behalf Of Peterson, Jon
Sent: 09 July 2016 02:17
To: IETF STIR Mail List <stir@ietf.org>
Subject: [stir] a syntax change

 

 

Attentive readers will observed a synta= x change in passport-04 which carries over to rfc4744bis-10. Implementers, = especially those looking forward to the SIPit coming up, should take note.

 

The change is to the claims of the PASS= porT object. Rather than having two different versions of each claim to ref= lect the originating and destination side, such as "otn" and "dtn", there is now simply a "tn&quo= t; claim. That claim will appear within a JSON array explicitly labeled as = "orig" or "dest" in the PASSporT object. 

 

This will result in PASSporT claims lik= e the following:

 

   =
   { "orig":{"tn":"12155551212"},
       =
 "dest":{"tn":"12155551213"},
       =
 "iat":"1443208345" }

 

The "dest" claim is specifica= lly defined to allow one or more values, so it replaces the previous "= dgrp" claim to be used in cases where a message has multiple destinations.

 

This eliminated the redundancy of havin= g future extensions to the PASSporT claims identify whether they carried an= identifier for the originating or destination side. Now, new claim definitions simply have to state that they contain id= entifiers: the semantics of the identifier will depend on whether it appear= s under "orig" or "dest". In fact, PASSporT could proba= bly work with some existing JWT claims now that represent identifiers. This seemed like a much better idea than the way we were doin= g it before.

 

This was a fairly last-minute fix, but = it didn't require much spec change and is hopefully stable and consistent. = Thoughts welcome.

 

Jon Peterson

Neustar, Inc.

 

 

--_000_7594FB04B1934943A5C02806D1A2204B476855E5ESESSMB208erics_-- From nobody Mon Jul 11 06:30:03 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 08F5112D185 for ; Mon, 11 Jul 2016 06:30:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.6 X-Spam-Level: X-Spam-Status: No, score=-102.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SXf6V0WUNr1B for ; Mon, 11 Jul 2016 06:30:00 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0a-0018ba01.pphosted.com [67.231.149.94]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8A706128E18 for ; Mon, 11 Jul 2016 06:30:00 -0700 (PDT) Received: from pps.filterd (m0078666.ppops.net [127.0.0.1]) by mx0a-0018ba01.pphosted.com (8.16.0.17/8.16.0.17) with SMTP id u6BDNFXW016159; Mon, 11 Jul 2016 09:29:57 -0400 Received: from stntexhc12.cis.neustar.com ([156.154.17.216]) by mx0a-0018ba01.pphosted.com with ESMTP id 242wcq3a75-1 (version=TLSv1 cipher=AES128-SHA bits=128 verify=NOT); Mon, 11 Jul 2016 09:29:57 -0400 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.94]) by stntexhc12.cis.neustar.com ([::1]) with mapi id 14.03.0279.002; Mon, 11 Jul 2016 09:29:56 -0400 From: "Peterson, Jon" To: Christer Holmberg Thread-Topic: a syntax change Thread-Index: AQHR2W7bzsTobHl6sEOOeZEJkt6dxqATONnwgAAE6Vs= Date: Mon, 11 Jul 2016 13:29:55 +0000 Message-ID: <2EF2D1DC-A510-42A8-BAA9-C2058F9EA782@neustar.biz> References: , <7594FB04B1934943A5C02806D1A2204B476855E5@ESESSMB208.ericsson.se> In-Reply-To: <7594FB04B1934943A5C02806D1A2204B476855E5@ESESSMB208.ericsson.se> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: multipart/alternative; boundary="_000_2EF2D1DCA51042A8BAA9C2058F9EA782neustarbiz_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-07-11_08:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1607110135 Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] a syntax change X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Jul 2016 13:30:02 -0000 --_000_2EF2D1DCA51042A8BAA9C2058F9EA782neustarbiz_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable I don't think we took a formal consensus call, or what have you. What we di= d do though is to include in rfc4474bis a URI normalization procedure that = we hope will obviate the ambiguity about URI comparisons you raised. I still think the message size reduction is worth the complexity trade-off = to permit "canon" not to be included - and if it is allowed to be absent at= all, then I think by default it should be absent. Jon Peterson Neustar, Inc. Sent from my iPad On Jul 11, 2016, at 9:13 AM, Christer Holmberg > wrote: Hi, Some time ago there was a discussion whether we should include the claims t= o begin with, as the information can be retrieved from other SIP informatio= n elements. Did we make a conclusion on that? Regards, Christer From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Peterson, Jon Sent: 09 July 2016 02:17 To: IETF STIR Mail List > Subject: [stir] a syntax change Attentive readers will observed a syntax change in passport-04 which carrie= s over to rfc4744bis-10. Implementers, especially those looking forward to = the SIPit coming up, should take note. The change is to the claims of the PASSporT object. Rather than having two = different versions of each claim to reflect the originating and destination= side, such as "otn" and "dtn", there is now simply a "tn" claim. That clai= m will appear within a JSON array explicitly labeled as "orig" or "dest" in= the PASSporT object. This will result in PASSporT claims like the following: { "orig":{"tn":"12155551212"}, "dest":{"tn":"12155551213"}, "iat":"1443208345" } The "dest" claim is specifically defined to allow one or more values, so it= replaces the previous "dgrp" claim to be used in cases where a message has= multiple destinations. This eliminated the redundancy of having future extensions to the PASSporT = claims identify whether they carried an identifier for the originating or d= estination side. Now, new claim definitions simply have to state that they = contain identifiers: the semantics of the identifier will depend on whether= it appears under "orig" or "dest". In fact, PASSporT could probably work w= ith some existing JWT claims now that represent identifiers. This seemed li= ke a much better idea than the way we were doing it before. This was a fairly last-minute fix, but it didn't require much spec change a= nd is hopefully stable and consistent. Thoughts welcome. Jon Peterson Neustar, Inc. --_000_2EF2D1DCA51042A8BAA9C2058F9EA782neustarbiz_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

I don't think we took a formal consensus cal= l, or what have you. What we did do though is to include in rfc4474bis a UR= I normalization procedure that we hope will obviate the ambiguity about URI= comparisons you raised. 

I still think the message size reduction is = worth the complexity trade-off to permit "canon" not to be includ= ed - and if it is allowed to be absent at all, then I think by default it s= hould be absent. 

Jon Peterson
Neustar, Inc.

Sent from my iPad

On Jul 11, 2016, at 9:13 AM, Christer Holmberg <christer.holmberg@ericsson.com> wrote:

Hi,

 = ;

Some time = ago there was a discussion whether we should include the claims to begin wi= th, as the information can be retrieved from other SIP information elements.

 = ;

Did we mak= e a conclusion on that?

 = ;

Regards,

 = ;

Christer

 

From: = stir [mailto:stir-bounces@ietf.org= ] On Behalf Of Peterson, Jon
Sent: 09 July 2016 02:17
To: IETF STIR Mail List <stir@ie= tf.org>
Subject: [stir] a syntax change

 

 

Attentive readers will observed a synta= x change in passport-04 which carries over to rfc4744bis-10. Implementers, = especially those looking forward to the SIPit coming up, should take note.

 

The change is to the claims of the PASS= porT object. Rather than having two different versions of each claim to ref= lect the originating and destination side, such as "otn" and "dtn", there is now simply a "tn&quo= t; claim. That claim will appear within a JSON array explicitly labeled as = "orig" or "dest" in the PASSporT object. 

 

This will result in PASSporT claims lik= e the following:

 

   =
   { "orig":{"tn":"12155551212"},
       =
 "dest":{"tn":"12155551213"},
       =
 "iat":"1443208345" }

 

The "dest" claim is specifica= lly defined to allow one or more values, so it replaces the previous "= dgrp" claim to be used in cases where a message has multiple destinations.

 

This eliminated the redundancy of havin= g future extensions to the PASSporT claims identify whether they carried an= identifier for the originating or destination side. Now, new claim definitions simply have to state that they contain id= entifiers: the semantics of the identifier will depend on whether it appear= s under "orig" or "dest". In fact, PASSporT could proba= bly work with some existing JWT claims now that represent identifiers. This seemed like a much better idea than the way we were doin= g it before.

 

This was a fairly last-minute fix, but = it didn't require much spec change and is hopefully stable and consistent. = Thoughts welcome.

 

Jon Peterson

Neustar, Inc.

 

 

--_000_2EF2D1DCA51042A8BAA9C2058F9EA782neustarbiz_-- From nobody Mon Jul 11 17:31:29 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2FBF212D097 for ; Mon, 11 Jul 2016 17:31:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=chriswendt-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DQ1A76uWGwFf for ; Mon, 11 Jul 2016 17:31:25 -0700 (PDT) Received: from mail-it0-x22d.google.com (mail-it0-x22d.google.com [IPv6:2607:f8b0:4001:c0b::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 35F9412B02A for ; Mon, 11 Jul 2016 17:31:25 -0700 (PDT) Received: by mail-it0-x22d.google.com with SMTP id f6so67776618ith.1 for ; Mon, 11 Jul 2016 17:31:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chriswendt-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc:message-id:references :to; bh=gQR/eifyDrqGofDqrH3Ig/5h+Mb7yMUT2EXsO7LWigk=; b=CEiXOeNcCIU1cTx4SH4ReTecgWsdvopx2n7qfLvDSAuqDawDfXlfuLoqYNyg9tsrR5 7lIRb5c06nKmgPQVYoc/kRlkX1i0LKku92wdzdGCei/cUGD5pgAglI1wROx6zh9uN3Jk iSWW4JnkQCpurNvQspR34nZvuWsLrjo4u+yN/J/XhYXRYHH28Li01C644pMSfoc+ktHw +oh4RPyeRMezdOZrWyzn9TYx7TSg8Zmk2pyjfSUKeRSbYiySihu5hb/ZdKB/9DfD4UMJ 7sLUlfJy+ZIdhonVhcmQvgW+ab2E2Aa4JRsCxkuSAKG1BwBXXzJNimFuKui4chz11GpS XXtg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; bh=gQR/eifyDrqGofDqrH3Ig/5h+Mb7yMUT2EXsO7LWigk=; b=Qew5EWDetFW4GBhgSjOsY7UcNG8p8ThCgZ8N+e4M5kDpa7gVK79AJ2kqPfGjKC6npN SQTpJOLq/rkBYmlm4TF+bDczg28qirkockbTDQWswI9agmlJ1AIjPMK5pjgAI4feqNPI MJCP3cisEK249VQ85uFLQ6QnbJly//oRcvWTkV7vi0vqeRAN+1FrX6KRhEMTybXqUnON h40WgtSk1wIYZ0iuzA5D1rCJmyRW+wtrqcQTLR87vQno7Bb3MIiTmSyDeR8WLxQkcQ5i dIcSnqOWkEvRE3gZhmIqIk659ek0oivMWqAV5Ns3MZ3wiAzrZoF/ydlGZr4/YIrWCBI/ OQtQ== X-Gm-Message-State: ALyK8tKaj0zpYDRLbwmuyiT2WjGKlVm6E6jpMjjL0cmzHN2o7BzVtD+XDguSfCcCJdZSqQ== X-Received: by 10.36.129.86 with SMTP id q83mr17013771itd.35.1468283484458; Mon, 11 Jul 2016 17:31:24 -0700 (PDT) Received: from [10.4.3.21] ([198.59.53.9]) by smtp.gmail.com with ESMTPSA id w78sm8552971ita.3.2016.07.11.17.31.23 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 11 Jul 2016 17:31:24 -0700 (PDT) Content-Type: multipart/alternative; boundary="Apple-Mail=_DCA37E0B-363B-43C5-823F-56BD163E7367" Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Chris Wendt In-Reply-To: <000001d1db20$99828800$cc879800$@transnexus.com> Date: Mon, 11 Jul 2016 18:31:22 -0600 Message-Id: References: <000001d1db20$99828800$cc879800$@transnexus.com> To: di-shi@transnexus.com X-Mailer: Apple Mail (2.3124) Archived-At: Cc: IETF STIR Mail List , "Peterson, Jon" Subject: Re: [stir] a syntax change X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Jul 2016 00:31:27 -0000 --Apple-Mail=_DCA37E0B-363B-43C5-823F-56BD163E7367 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Hi Di-Shi, Good catch, yes we must wrap the identity name/value pairs with brackets = as an array if there is more than one. Thanks. -Chris > On Jul 10, 2016, at 9:01 PM, Di-Shi Sun wrote: >=20 > Does the example in draft-ietf-stir-passport-04 satisfy JSON rules? = There are two uri in dest but they are not array. > =20 > { > "iat":"1443208345", > "orig":{ > "tn":"12155551212" > }, > "dest":{ > "uri":"sip:alice@example.com = ", > "tn":"12125551212", > "uri":"sip:bob@example.net = " > } > } > =20 > Thanks, > =20 > Di-Shi Sun. > From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Peterson, Jon > Sent: Saturday, July 09, 2016 7:17 AM > To: IETF STIR Mail List > Subject: [stir] a syntax change > =20 > =20 > Attentive readers will observed a syntax change in passport-04 which = carries over to rfc4744bis-10. Implementers, especially those looking = forward to the SIPit coming up, should take note. > =20 > The change is to the claims of the PASSporT object. Rather than having = two different versions of each claim to reflect the originating and = destination side, such as "otn" and "dtn", there is now simply a "tn" = claim. That claim will appear within a JSON array explicitly labeled as = "orig" or "dest" in the PASSporT object.=20 > =20 > This will result in PASSporT claims like the following: > =20 > { "orig":{"tn":"12155551212"}, > "dest":{"tn":"12155551213"}, > "iat":"1443208345" } > =20 > The "dest" claim is specifically defined to allow one or more values, = so it replaces the previous "dgrp" claim to be used in cases where a = message has multiple destinations. > =20 > This eliminated the redundancy of having future extensions to the = PASSporT claims identify whether they carried an identifier for the = originating or destination side. Now, new claim definitions simply have = to state that they contain identifiers: the semantics of the identifier = will depend on whether it appears under "orig" or "dest". In fact, = PASSporT could probably work with some existing JWT claims now that = represent identifiers. This seemed like a much better idea than the way = we were doing it before. > =20 > This was a fairly last-minute fix, but it didn't require much spec = change and is hopefully stable and consistent. Thoughts welcome. > =20 > Jon Peterson > Neustar, Inc. > =20 > =20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir --Apple-Mail=_DCA37E0B-363B-43C5-823F-56BD163E7367 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Hi Di-Shi,

Good catch, yes we must wrap the identity name/value pairs = with brackets as an array if there is more than one.

Thanks.

-Chris

On Jul 10, 2016, at 9:01 PM, Di-Shi Sun <di-shi@transnexus.com> wrote:

Does the example in = draft-ietf-stir-passport-04 satisfy JSON rules? There are two uri in = dest but they are not array.
 
{
          &nb= sp;     "iat":"1443208345",
          &nb= sp;     "orig":{
          &nb= sp;            = ;         "tn":"12155551212"
          &nb= sp;     },
          &nb= sp;     "dest":{
          &nb= sp;            = ;         "uri":"sip:alice@example.com",
          &nb= sp;            = ;         = "tn":"12125551212",
          &nb= sp;            = ;         "uri":"sip:bob@example.net"
          &nb= sp;     }
}
 
Thanks,
 
Di-Shi Sun.
From: stir [mailto:stir-bounces@ietf.org] On Behalf = Of Peterson, = Jon
Sent: Saturday, July 09, 2016 = 7:17 AM
To: IETF STIR Mail List
Subject: [stir] a syntax change
 
 
Attentive readers will = observed a syntax change in passport-04 which carries over to = rfc4744bis-10. Implementers, especially those looking forward to the = SIPit coming up, should take note.
 
The change is to the = claims of the PASSporT object. Rather than having two different versions = of each claim to reflect the originating and destination side, such as = "otn" and "dtn", there is now simply a "tn" claim. That claim will = appear within a JSON array explicitly labeled as "orig" or "dest" in the = PASSporT object. 
 
This will result in PASSporT claims like the following:
 
      { =
"orig":{"tn":"12155551212"},
        =
"dest":{"tn":"12155551213"},
        "iat":"1443208345" =
}
 
The "dest" claim is = specifically defined to allow one or more values, so it replaces the = previous "dgrp" claim to be used in cases where a message has multiple = destinations.
 
This eliminated the = redundancy of having future extensions to the PASSporT claims identify = whether they carried an identifier for the originating or destination = side. Now, new claim definitions simply have to state that they contain = identifiers: the semantics of the identifier will depend on whether it = appears under "orig" or "dest". In fact, PASSporT could probably work = with some existing JWT claims now that represent identifiers. This = seemed like a much better idea than the way we were doing it before.
 
This was a fairly = last-minute fix, but it didn't require much spec change and is hopefully = stable and consistent. Thoughts welcome.
 
Jon Peterson
Neustar, Inc.
 
 
_______________________________________________
stir mailing = list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir

= --Apple-Mail=_DCA37E0B-363B-43C5-823F-56BD163E7367-- From nobody Mon Jul 11 17:50:34 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B3A2D12D6AB for ; Mon, 11 Jul 2016 17:50:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=chriswendt-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PN--b_XWPrkw for ; Mon, 11 Jul 2016 17:50:30 -0700 (PDT) Received: from mail-io0-x22c.google.com (mail-io0-x22c.google.com [IPv6:2607:f8b0:4001:c06::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 879DA12B031 for ; Mon, 11 Jul 2016 17:50:30 -0700 (PDT) Received: by mail-io0-x22c.google.com with SMTP id b62so3071183iod.3 for ; Mon, 11 Jul 2016 17:50:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chriswendt-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc:message-id:references :to; bh=MvXOZxwBGyocUbzxzbC16KYxs3xcXusaFeI7MaBjtII=; b=OxIXqeM5+5dyWm3gbo2ltdBdHnzmPswxW6NE13Rz/X93vcjQr+G654haXKSJU3WsuB meM1oOekGQWaUN2mdyMNJkFMvmk4f6D1g81X9alf5m1vldFxo6iIuGl4hCOE7+GQxK7L seZA0gGA6yY6+ijtYBAbgXnzY2TkCy+ofCWlEQlTIoJbSukFv3OM+4pG/ZzQX3oMzrny rGLew2xPxxjnMUbiRKqLow7i29NcD1CQNFQUyPdvX5qqdRORcU6KzpLs1aSKaj1o9R2D ra+oxcZlenX0mrwyQJcZsJ0N4H431tV+zhEQCy83YD8ePudkgKeohnZlAcx5l8HgsVyM /JOQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; bh=MvXOZxwBGyocUbzxzbC16KYxs3xcXusaFeI7MaBjtII=; b=Qp1aTLk3HAYB+Udyhr1exMv/SYYk1Y6eMQo4/0OlqzJaKPVwzbYORGKDFYc8KQTdNI +lAqKecRMdsHp+szFQoQ7TcJVIH2TiF4itasQI3R10E2XTo5AQJhDR8ePkV//lWfZ+Kw HwWRG/Xrqv7AhE7vYBBpiO/RsYe+8B2uEXkw0izK/ZTk7+ENsRtSiceCjeHBEr13WV22 toLUsMLuB77hU3WZg7q+psIP/1tOpOrHwBW99bv6XTgDJ/YzGBHTVrFjRKcBuBKGWVVq fMw+uruPPG2egUUNACGWkNGuyd9maAQep11m6CShi8PhuzNWsgHhpr8SBkPgBPynrJ6z zPlw== X-Gm-Message-State: ALyK8tJBDOIKDQI5SvGHFiFVqa5BT3wOfRRPKT3Gzb1IXGRihusWcfYxmaJGN1ADFqGCGw== X-Received: by 10.107.51.21 with SMTP id z21mr22596481ioz.176.1468284629832; Mon, 11 Jul 2016 17:50:29 -0700 (PDT) Received: from [10.4.3.21] ([198.59.53.9]) by smtp.gmail.com with ESMTPSA id h99sm730307iod.9.2016.07.11.17.50.29 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 11 Jul 2016 17:50:29 -0700 (PDT) Content-Type: multipart/alternative; boundary="Apple-Mail=_ECF76587-AEE4-43B4-B393-8BB422A025E6" Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Chris Wendt In-Reply-To: <2EF2D1DC-A510-42A8-BAA9-C2058F9EA782@neustar.biz> Date: Mon, 11 Jul 2016 18:50:28 -0600 Message-Id: <96FA6E44-83FF-41B1-A8C3-63620B813937@chriswendt.net> References: <7594FB04B1934943A5C02806D1A2204B476855E5@ESESSMB208.ericsson.se> <2EF2D1DC-A510-42A8-BAA9-C2058F9EA782@neustar.biz> To: "Peterson, Jon" X-Mailer: Apple Mail (2.3124) Archived-At: Cc: IETF STIR Mail List , Christer Holmberg Subject: Re: [stir] a syntax change X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Jul 2016 00:50:33 -0000 --Apple-Mail=_ECF76587-AEE4-43B4-B393-8BB422A025E6 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Relevant to this topic, I think one other valid discussion point that we = may or may not have talked about on the list or face to face is how = often we think the date header will be changed in transit. The current rule is if signature verification fails a 438 is sent back = and the authentication service should sent the INVITE with an identity = header with canon parameter and the full token with the date explicitly = included. If we believe the date header will be changed often, then we obviously = don=E2=80=99t want a high percentage of SIP calls creating 438 errors to = force new INVITES (or effectively sending INVITEs twice) Perhaps, for some real-world applications there is a low chance of a = date header change because the call path is fairly predictable, and the = cases where a 438 happens is very rare. Then favoring the current = default is correct. =20 But, for example, in situation where many B2BUAs are part of the = application, you may have a very decent chance that someone is going to = change a date header out of your control, we may want canon because = sending the invite twice is more expensive than saving the header and = claims bytes in the first place. One approach is rely on industry SIP profile documents to define such = things to send =E2=80=9Ccanon=E2=80=9D for every call. I don=E2=80=99t = think anything in 4474bis prevents that, correct me if I=E2=80=99m wrong = Jon. The question I think would be good to get more input on is if date = header changes are more common or rare in most peoples operational = experience.=20 Thanks. -Chris > On Jul 11, 2016, at 7:29 AM, Peterson, Jon = wrote: >=20 >=20 > I don't think we took a formal consensus call, or what have you. What = we did do though is to include in rfc4474bis a URI normalization = procedure that we hope will obviate the ambiguity about URI comparisons = you raised.=20 >=20 > I still think the message size reduction is worth the complexity = trade-off to permit "canon" not to be included - and if it is allowed to = be absent at all, then I think by default it should be absent.=20 >=20 > Jon Peterson > Neustar, Inc. >=20 > Sent from my iPad >=20 > On Jul 11, 2016, at 9:13 AM, Christer Holmberg = > = wrote: >=20 >> Hi, >> =20 >> Some time ago there was a discussion whether we should include the = claims to begin with, as the information can be retrieved from other SIP = information elements. >> =20 >> Did we make a conclusion on that? >> =20 >> Regards, >> =20 >> Christer >> =C2=A0 <> >> From: stir [mailto:stir-bounces@ietf.org = ] On Behalf Of Peterson, Jon >> Sent: 09 July 2016 02:17 >> To: IETF STIR Mail List > >> Subject: [stir] a syntax change >> =20 >> =20 >> Attentive readers will observed a syntax change in passport-04 which = carries over to rfc4744bis-10. Implementers, especially those looking = forward to the SIPit coming up, should take note. >> =20 >> The change is to the claims of the PASSporT object. Rather than = having two different versions of each claim to reflect the originating = and destination side, such as "otn" and "dtn", there is now simply a = "tn" claim. That claim will appear within a JSON array explicitly = labeled as "orig" or "dest" in the PASSporT object.=20 >> =20 >> This will result in PASSporT claims like the following: >> =20 >> { "orig":{"tn":"12155551212"}, >> "dest":{"tn":"12155551213"}, >> "iat":"1443208345" } >> =20 >> The "dest" claim is specifically defined to allow one or more values, = so it replaces the previous "dgrp" claim to be used in cases where a = message has multiple destinations. >> =20 >> This eliminated the redundancy of having future extensions to the = PASSporT claims identify whether they carried an identifier for the = originating or destination side. Now, new claim definitions simply have = to state that they contain identifiers: the semantics of the identifier = will depend on whether it appears under "orig" or "dest". In fact, = PASSporT could probably work with some existing JWT claims now that = represent identifiers. This seemed like a much better idea than the way = we were doing it before. >> =20 >> This was a fairly last-minute fix, but it didn't require much spec = change and is hopefully stable and consistent. Thoughts welcome. >> =20 >> Jon Peterson >> Neustar, Inc. >> =20 >> =20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir --Apple-Mail=_ECF76587-AEE4-43B4-B393-8BB422A025E6 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Relevant to this topic, I think one other valid discussion = point that we may or may not have talked about on the list or face to = face is how often we think the date header will be changed in = transit.

The current = rule is if signature verification fails a 438 is sent back and the = authentication service should sent the INVITE with an identity header = with canon parameter and the full token with the date explicitly = included.

If = we believe the date header will be changed often, then we obviously = don=E2=80=99t want a high percentage of SIP calls creating 438 errors to = force new INVITES (or effectively sending INVITEs twice)

Perhaps, for some = real-world applications there is a low chance of a date header change = because the call path is fairly predictable, and the cases where a 438 = happens is very rare.  Then favoring the current default is = correct.  

But, for example, in situation where many B2BUAs are part of = the application, you may have a very decent chance that someone is going = to change a date header out of your control, we may want canon because = sending the invite twice is more expensive than saving the header and = claims bytes in the first place.

One approach is rely on industry SIP = profile documents to define such things to send =E2=80=9Ccanon=E2=80=9D = for every call.  I don=E2=80=99t think anything in 4474bis prevents = that, correct me if I=E2=80=99m wrong Jon.

The question I think would be good to = get more input on is if date header changes are more common or rare in = most peoples operational experience. 

Thanks.

-Chris

On = Jul 11, 2016, at 7:29 AM, Peterson, Jon <jon.peterson@neustar.biz> wrote:


I don't think we took a formal = consensus call, or what have you. What we did do though is to include in = rfc4474bis a URI normalization procedure that we hope will obviate the = ambiguity about URI comparisons you raised. 

I still think the message = size reduction is worth the complexity trade-off to permit "canon" not = to be included - and if it is allowed to be absent at all, then I think = by default it should be absent. 

Jon Peterson
Neustar, Inc.

Sent from my = iPad

On Jul 11, 2016, at 9:13 AM, Christer Holmberg <christer.holmberg@ericsson.com> wrote:
Hi,
 
Some time ago there was = a discussion whether we should include the claims to begin with, as the = information can be retrieved from other SIP information elements.
 
Did we make a = conclusion on that?
 
Regards,
 
Christer
 
From: stir [mailto:stir-bounces@ietf.org] On Behalf = Of Peterson, = Jon
Sent: 09 July 2016 02:17
To: IETF STIR Mail List <stir@ietf.org>
Subject: [stir] a syntax change
 
 
Attentive readers will = observed a syntax change in passport-04 which carries over to = rfc4744bis-10. Implementers, especially those looking forward to the = SIPit coming up, should take note.
 
The change is to the = claims of the PASSporT object. Rather than having two different versions = of each claim to reflect the originating and destination side, such as = "otn" and "dtn", there is now simply a "tn" claim. That claim will = appear within a JSON array explicitly labeled as "orig" or "dest" in the = PASSporT object. 
 
This will result in PASSporT claims like the following:
 
      { =
"orig":{"tn":"12155551212"},
        =
"dest":{"tn":"12155551213"},
        "iat":"1443208345" =
}
 
The "dest" claim is = specifically defined to allow one or more values, so it replaces the = previous "dgrp" claim to be used in cases where a message has multiple = destinations.
 
This eliminated the = redundancy of having future extensions to the PASSporT claims identify = whether they carried an identifier for the originating or destination = side. Now, new claim definitions simply have to state that they contain = identifiers: the semantics of the identifier will depend on whether it = appears under "orig" or "dest". In fact, PASSporT could probably work = with some existing JWT claims now that represent identifiers. This = seemed like a much better idea than the way we were doing it before.
 
This was a fairly = last-minute fix, but it didn't require much spec change and is hopefully = stable and consistent. Thoughts welcome.
 
Jon Peterson
Neustar, Inc.
 
 
_______________________________________________
stir mailing = list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir

= --Apple-Mail=_ECF76587-AEE4-43B4-B393-8BB422A025E6-- From nobody Wed Jul 13 12:20:21 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0685812B043 for ; Wed, 13 Jul 2016 12:20:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.9 X-Spam-Level: X-Spam-Status: No, score=-101.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Iowh0ARrvAz0 for ; Wed, 13 Jul 2016 12:20:18 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9C20912D0B2 for ; Wed, 13 Jul 2016 12:20:18 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 879C33004EE for ; Wed, 13 Jul 2016 15:20:16 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id KLb6TVC0wH2K for ; Wed, 13 Jul 2016 15:20:15 -0400 (EDT) Received: from [192.168.2.100] (pool-108-51-128-219.washdc.fios.verizon.net [108.51.128.219]) by mail.smeinc.net (Postfix) with ESMTPSA id 8A58F3002C2 for ; Wed, 13 Jul 2016 15:20:15 -0400 (EDT) From: Russ Housley Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Date: Wed, 13 Jul 2016 15:20:16 -0400 Message-Id: To: IETF STIR Mail List Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) X-Mailer: Apple Mail (2.1878.6) Archived-At: Subject: [stir] Consensus Call Regarding Early Codepoint Allocation X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: IETF STIR Mail List List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Jul 2016 19:20:20 -0000 The STIR Certificates document (draft-ietf-stir-certificates-07.txt) calls for IANA to allocation four codepoints: o TN Certificate Extension in the SMI Security for PKIX Certificate Extension registry: http://www.iana.org/assignments/smi-numbers/ smi-numbers.xhtml#smi-numbers-1.3.6.1.5.5.7.1 o TN-HVE OCSP extension in the SMI Security for PKIX Online Certificate Status Protocol (OCSP) registry: http://www.iana.org/assignments/smi-numbers/smi-numbers.xhtml#smi- numbers-1.3.6.1.5.5.7.48.1 o TNS by reference access descriptor in the SMI Security for PKIX Access Descriptor registry: http://www.iana.org/assignments/smi- numbers/smi-numbers.xhtml#smi-numbers-1.3.6.1.5.5.7.48 o The TN ASN.1 module in SMI Security for PKIX Module Identifier registry: http://www.iana.org/assignments/smi-numbers/smi- numbers.xhtml#smi-numbers-1.3.6.1.5.5.7.0 The document authors have requested that IANA perform an early allocation of these codepoints. Consensus of the STIR WG is needed for the IESG to request early allocation. Please let us know whether you support early codepoint allocation. Thanks, Russ From nobody Wed Jul 13 12:25:53 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4B25B12D52F for ; Wed, 13 Jul 2016 12:25:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.62 X-Spam-Level: X-Spam-Status: No, score=-2.62 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NBqOhru8YzQ7 for ; Wed, 13 Jul 2016 12:25:51 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0b-00191d01.pphosted.com [67.231.157.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EE15712D19E for ; Wed, 13 Jul 2016 12:25:50 -0700 (PDT) Received: from pps.filterd (m0083689.ppops.net [127.0.0.1]) by m0083689.ppops.net-00191d01. (8.16.0.11/8.16.0.11) with SMTP id u6DJNwqb020987 for ; Wed, 13 Jul 2016 15:25:50 -0400 Received: from alpi155.enaf.aldc.att.com (sbcsmtp7.sbc.com [144.160.229.24]) by m0083689.ppops.net-00191d01. with ESMTP id 245udg8n04-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Wed, 13 Jul 2016 15:25:50 -0400 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id u6DJPn3V012086 for ; Wed, 13 Jul 2016 15:25:49 -0400 Received: from mlpi409.sfdc.sbc.com (mlpi409.sfdc.sbc.com [130.9.128.241]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id u6DJPg2v011883 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO) for ; Wed, 13 Jul 2016 15:25:42 -0400 Received: from MISOUT7MSGHUBAC.ITServices.sbc.com (MISOUT7MSGHUBAC.itservices.sbc.com [130.9.129.147]) by mlpi409.sfdc.sbc.com (RSA Interceptor) for ; Wed, 13 Jul 2016 19:25:27 GMT Received: from MISOUT7MSGUSRDB.ITServices.sbc.com ([169.254.2.33]) by MISOUT7MSGHUBAC.ITServices.sbc.com ([130.9.129.147]) with mapi id 14.03.0294.000; Wed, 13 Jul 2016 15:25:26 -0400 From: "DOLLY, MARTIN C" To: IETF STIR Mail List Thread-Topic: [stir] Consensus Call Regarding Early Codepoint Allocation Thread-Index: AQHR3Tue6Hodx0Kzck22JLEdCZubXKAWviZd Date: Wed, 13 Jul 2016 19:25:25 +0000 Message-ID: <3A38E008-748D-450A-8A58-A08EF4C972C8@att.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-RSA-Inspected: yes X-RSA-Classifications: public X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-07-13_10:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1607130211 Archived-At: Subject: Re: [stir] Consensus Call Regarding Early Codepoint Allocation X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Jul 2016 19:25:52 -0000 I support early code point allocation Regards Martin C Dolly Lead Member of Technical Staff Core & Government/Regulatory Standards=20 AT&T Cell: 609-903-3360 Email: md3135@att.com > On Jul 13, 2016, at 3:20 PM, Russ Housley wrote: >=20 > The STIR Certificates document (draft-ietf-stir-certificates-07.txt) > calls for IANA to allocation four codepoints: >=20 > o TN Certificate Extension in the SMI Security for PKIX Certificate > Extension registry: http://www.iana.org/assignments/smi-numbers/ > smi-numbers.xhtml#smi-numbers-1.3.6.1.5.5.7.1 >=20 > o TN-HVE OCSP extension in the SMI Security for PKIX Online > Certificate Status Protocol (OCSP) registry: > http://www.iana.org/assignments/smi-numbers/smi-numbers.xhtml#smi- > numbers-1.3.6.1.5.5.7.48.1 >=20 > o TNS by reference access descriptor in the SMI Security for PKIX > Access Descriptor registry: http://www.iana.org/assignments/smi- > numbers/smi-numbers.xhtml#smi-numbers-1.3.6.1.5.5.7.48 >=20 > o The TN ASN.1 module in SMI Security for PKIX Module Identifier > registry: http://www.iana.org/assignments/smi-numbers/smi- > numbers.xhtml#smi-numbers-1.3.6.1.5.5.7.0=20 >=20 > The document authors have requested that IANA perform an early > allocation of these codepoints. Consensus of the STIR WG is needed > for the IESG to request early allocation. >=20 > Please let us know whether you support early codepoint allocation. >=20 > Thanks, > Russ >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir From nobody Wed Jul 13 12:49:47 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4119212D0A4 for ; Wed, 13 Jul 2016 12:49:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.9 X-Spam-Level: X-Spam-Status: No, score=-101.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, USER_IN_WHITELIST=-100] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OK9HNQjQOavt for ; Wed, 13 Jul 2016 12:49:44 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9F99B12D54F for ; Wed, 13 Jul 2016 12:44:18 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id B59E730053F for ; Wed, 13 Jul 2016 15:44:16 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id EP-psVQuRz9S for ; Wed, 13 Jul 2016 15:44:15 -0400 (EDT) Received: from [192.168.2.100] (pool-108-51-128-219.washdc.fios.verizon.net [108.51.128.219]) by mail.smeinc.net (Postfix) with ESMTPSA id 8FB4C3002C2 for ; Wed, 13 Jul 2016 15:44:15 -0400 (EDT) From: Russ Housley Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Date: Wed, 13 Jul 2016 15:43:47 -0400 Message-Id: To: IETF STIR Mail List Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) X-Mailer: Apple Mail (2.1878.6) Archived-At: Subject: [stir] WG Last Call for STIR Certificates Document X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: IETF STIR Mail List List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Jul 2016 19:49:45 -0000 The authors of the STIR Certificates document (https://www.ietf.org/id/draft-ietf-stir-certificates-07.txt) have stated that the document is mature and ready for WG Last Call. This message starts a two week WG Last Call for the STIR Certificates document, which will end on 27 July 2016. Ideally major concerns will be raised quickly so that they can be tackled during IETF 96. Please review the document and send comments on it to the STIR WG mail list. Please clearly state your opinion as to whether the document is ready for publication as a standards-track RFC. Remember that support for publication is needed. Thanks, Russ & Robert From nobody Wed Jul 13 12:58:16 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EE76012D159 for ; Wed, 13 Jul 2016 12:58:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.9 X-Spam-Level: X-Spam-Status: No, score=-101.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hNtVv-VrWlHB for ; Wed, 13 Jul 2016 12:58:12 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 94F7612D0A4 for ; Wed, 13 Jul 2016 12:58:12 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id A41783004CD for ; Wed, 13 Jul 2016 15:58:10 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id MO4uNwBZ5Gqp for ; Wed, 13 Jul 2016 15:58:09 -0400 (EDT) Received: from [192.168.2.100] (pool-108-51-128-219.washdc.fios.verizon.net [108.51.128.219]) by mail.smeinc.net (Postfix) with ESMTPSA id 9F7CA3002C2 for ; Wed, 13 Jul 2016 15:58:09 -0400 (EDT) From: Russ Housley Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Date: Wed, 13 Jul 2016 15:58:10 -0400 Message-Id: To: IETF STIR Mail List Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) X-Mailer: Apple Mail (2.1878.6) Archived-At: Subject: [stir] WG Last Call for RFC4474bis X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: IETF STIR Mail List List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Jul 2016 19:58:14 -0000 The authors of the Authenticated Identity Management in SIP document (https://www.ietf.org/id/draft-ietf-stir-rfc4474bis-10.txt) have stated that the document is mature and ready for WG Last Call. This message starts a two week WG Last Call for that document, which will end on 27 July 2016. Ideally major concerns will be raised quickly so that they can be tackled during IETF 96. Please review the document and send comments on it to the STIR WG mail list. Please clearly state your opinion as to whether the document is ready for publication as a standards-track RFC. Remember that support for publication is needed. Thanks, Russ & Robert From nobody Wed Jul 13 13:00:30 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 50A4812D13B for ; Wed, 13 Jul 2016 13:00:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.9 X-Spam-Level: X-Spam-Status: No, score=-101.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fiT7yt5DTAmE for ; Wed, 13 Jul 2016 13:00:28 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1482C12D0A4 for ; Wed, 13 Jul 2016 13:00:28 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 246343004CC for ; Wed, 13 Jul 2016 16:00:26 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id DGieXDJDOnka for ; Wed, 13 Jul 2016 16:00:24 -0400 (EDT) Received: from [192.168.2.100] (pool-108-51-128-219.washdc.fios.verizon.net [108.51.128.219]) by mail.smeinc.net (Postfix) with ESMTPSA id 2F7273002C2 for ; Wed, 13 Jul 2016 16:00:24 -0400 (EDT) From: Russ Housley Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Date: Wed, 13 Jul 2016 16:00:25 -0400 Message-Id: To: IETF STIR Mail List Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) X-Mailer: Apple Mail (2.1878.6) Archived-At: Subject: [stir] WG Last Call for PASSporT Document X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: IETF STIR Mail List List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Jul 2016 20:00:29 -0000 The authors of the Persona Assertion Token (PASSporT) document (https://www.ietf.org/id/draft-ietf-stir-passport-04.txt) have stated that the document is mature and ready for WG Last Call. This message starts a two week WG Last Call for that document, which will end on 27 July 2016. Ideally major concerns will be raised quickly so that they can be tackled during IETF 96. Please review the document and send comments on it to the STIR WG mail list. Please clearly state your opinion as to whether the document is ready for publication as a standards-track RFC. Remember that support for publication is needed. Thanks, Russ & Robert From nobody Wed Jul 13 13:57:29 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 88C2C12D893 for ; Wed, 13 Jul 2016 13:57:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.22 X-Spam-Level: X-Spam-Status: No, score=-4.22 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bv_HLkT5WOrK for ; Wed, 13 Jul 2016 13:57:25 -0700 (PDT) Received: from sessmg22.ericsson.net (sessmg22.ericsson.net [193.180.251.58]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C52F312D888 for ; Wed, 13 Jul 2016 13:57:24 -0700 (PDT) X-AuditID: c1b4fb3a-f79386d00000467b-f8-5786ab32d202 Received: from ESESSHC001.ericsson.se (Unknown_Domain [153.88.183.21]) by sessmg22.ericsson.net (Symantec Mail Security) with SMTP id E1.41.18043.23BA6875; Wed, 13 Jul 2016 22:57:23 +0200 (CEST) Received: from ESESSMB208.ericsson.se ([169.254.8.19]) by ESESSHC001.ericsson.se ([153.88.183.21]) with mapi id 14.03.0294.000; Wed, 13 Jul 2016 22:57:22 +0200 From: Christer Holmberg To: "Peterson, Jon" Thread-Topic: a syntax change Thread-Index: AQHR2W7bzsTobHl6sEOOeZEJkt6dxqATONnwgAAE6VuAA6FDkA== Date: Wed, 13 Jul 2016 20:57:22 +0000 Message-ID: <7594FB04B1934943A5C02806D1A2204B476A7DB3@ESESSMB208.ericsson.se> References: , <7594FB04B1934943A5C02806D1A2204B476855E5@ESESSMB208.ericsson.se> <2EF2D1DC-A510-42A8-BAA9-C2058F9EA782@neustar.biz> In-Reply-To: <2EF2D1DC-A510-42A8-BAA9-C2058F9EA782@neustar.biz> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [153.88.183.150] Content-Type: multipart/alternative; boundary="_000_7594FB04B1934943A5C02806D1A2204B476A7DB3ESESSMB208erics_" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprHIsWRmVeSWpSXmKPExsUyM2K7qK7x6rZwgzvv2C3ONFhaLF+7jcmB yWPJkp9MHjsanjMHMEVx2aSk5mSWpRbp2yVwZaxqFCpYVlcxaeIilgbGCQVdjJwcEgImEjcW fWeEsMUkLtxbz9bFyMUhJHCEUaKn+z4jhLOYUWL+45tMXYwcHGwCFhLd/7RBGkQE9CS+fZ/B BGIzC6hLvHj0hh3EFhaQkZi84gAbRI2sxJx5V8BaRQScJOY2F4KEWQRUJTaeWAbWyivgK7G4 +SjU3rWMEhdanzODJDgF7CVevvwBNpMR6Ljvp9ZA7RKXuPVkPhPE0QISS/acZ4awRSVePv7H CmErSazYfokRoj5fYu3VpSwQywQlTs58wjKBUXQWklGzkJTNQlIGEdeRWLD7ExuErS2xbOFr Zhj7zIHHTMjiCxjZVzGKFqcWF+emGxnppRZlJhcX5+fp5aWWbGIExtrBLb+tdjAefO54iFGA g1GJh3dBY1u4EGtiWXFl7iFGCQ5mJRHe+auAQrwpiZVVqUX58UWlOanFhxilOViUxHn9XyqG CwmkJ5akZqemFqQWwWSZODilGhgNjqrHM0uKRuawGe8Md0xxvWamlbZL+2tmJv+hc2w51u9f rri2M3naG+cfIvkPHNaslxPr/yD5ctPyp5JP3cylmpdMW9EUs0I/qZbjr3OHiZn+am+D+0JH I44/C6uefIv/JO+Cl1lODRmZKVrRRzgnCMoG+r+N/FmzPuTphnaDqmsORwXyzJRYijMSDbWY i4oTAQd9MAGxAgAA Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] a syntax change X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Jul 2016 20:57:27 -0000 --_000_7594FB04B1934943A5C02806D1A2204B476A7DB3ESESSMB208erics_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi, >I don't think we took a formal consensus call, or what have you. What we d= id do though is to >include in rfc4474bis a URI normalization procedure tha= t we hope will obviate the ambiguity >about URI comparisons you raised. Thanks, I'll have a look :) >I still think the message size reduction is worth the complexity trade-off= to permit "canon" not >to be included - and if it is allowed to be absent = at all, then I think by default it should be >absent. The claims are allowed to be absent, if they can be retrieved in other ways= . It is described in Appendix F of RFC 7315. Regards, Christer Sent from my iPad On Jul 11, 2016, at 9:13 AM, Christer Holmberg > wrote: Hi, Some time ago there was a discussion whether we should include the claims t= o begin with, as the information can be retrieved from other SIP informatio= n elements. Did we make a conclusion on that? Regards, Christer From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Peterson, Jon Sent: 09 July 2016 02:17 To: IETF STIR Mail List > Subject: [stir] a syntax change Attentive readers will observed a syntax change in passport-04 which carrie= s over to rfc4744bis-10. Implementers, especially those looking forward to = the SIPit coming up, should take note. The change is to the claims of the PASSporT object. Rather than having two = different versions of each claim to reflect the originating and destination= side, such as "otn" and "dtn", there is now simply a "tn" claim. That clai= m will appear within a JSON array explicitly labeled as "orig" or "dest" in= the PASSporT object. This will result in PASSporT claims like the following: { "orig":{"tn":"12155551212"}, "dest":{"tn":"12155551213"}, "iat":"1443208345" } The "dest" claim is specifically defined to allow one or more values, so it= replaces the previous "dgrp" claim to be used in cases where a message has= multiple destinations. This eliminated the redundancy of having future extensions to the PASSporT = claims identify whether they carried an identifier for the originating or d= estination side. Now, new claim definitions simply have to state that they = contain identifiers: the semantics of the identifier will depend on whether= it appears under "orig" or "dest". In fact, PASSporT could probably work w= ith some existing JWT claims now that represent identifiers. This seemed li= ke a much better idea than the way we were doing it before. This was a fairly last-minute fix, but it didn't require much spec change a= nd is hopefully stable and consistent. Thoughts welcome. Jon Peterson Neustar, Inc. --_000_7594FB04B1934943A5C02806D1A2204B476A7DB3ESESSMB208erics_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi,

 

>I don't thi= nk we took a formal consensus call, or what have you. What we did do though= is to >include in rfc4474bis a URI normal= ization procedure that we hope will obviate the ambiguity >about URI comparisons you raised.&= nbsp;

 

Thanks, I’ll have a look :)

 

>I still thi= nk the message size reduction is worth the complexity trade-off to permit &= quot;canon" not >to be included - and if it is allo= wed to be absent at all, then I think by default it should be >absent. 

 

The claims are allowed to be absent, = if they can be retrieved in other ways. It is described in Appendix F of RF= C 7315.

 

Regards,

 

Christer

 


Sent from my iPad


On Jul 11, 2016, at 9:13 AM, Christer Holmberg <christer.holmberg@ericsson.com> wrote:

Hi,=

 

Some time = ago there was a discussion whether we should include the claims to begin wi= th, as the information can be retrieved from other SIP information elements.

 

Did we mak= e a conclusion on that?

 

Regards,

 

Christer

 

From: = stir [mailto:stir-bounces@ietf.org= ] On Behalf Of Peterson, Jon
Sent: 09 July 2016 02:17
To: IETF STIR Mail List <stir@ie= tf.org>
Subject: [stir] a syntax change

 

 

Attentive readers will observed a synta= x change in passport-04 which carries over to rfc4744bis-10. Implementers, = especially those looking forward to the SIPit coming up, should take note.

 

The change is to the claims of the PASS= porT object. Rather than having two different versions of each claim to ref= lect the originating and destination side, such as "otn" and "dtn", there is now simply a "tn&quo= t; claim. That claim will appear within a JSON array explicitly labeled as = "orig" or "dest" in the PASSporT object. 

 

This will result in PASSporT claims lik= e the following:

 

   =
   { "orig":{"tn":"12155551212"},
       =
 "dest":{"tn":"12155551213"},
       =
 "iat":"1443208345" }

 

The "dest" claim is specifica= lly defined to allow one or more values, so it replaces the previous "= dgrp" claim to be used in cases where a message has multiple destinations.

 

This eliminated the redundancy of havin= g future extensions to the PASSporT claims identify whether they carried an= identifier for the originating or destination side. Now, new claim definitions simply have to state that they contain id= entifiers: the semantics of the identifier will depend on whether it appear= s under "orig" or "dest". In fact, PASSporT could proba= bly work with some existing JWT claims now that represent identifiers. This seemed like a much better idea than the way we were doin= g it before.

 

This was a fairly last-minute fix, but = it didn't require much spec change and is hopefully stable and consistent. = Thoughts welcome.

 

Jon Peterson

Neustar, Inc.

 

 

--_000_7594FB04B1934943A5C02806D1A2204B476A7DB3ESESSMB208erics_-- From nobody Wed Jul 13 14:09:06 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 695D512D8F2 for ; Wed, 13 Jul 2016 14:09:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y82XMyYzCLft for ; Wed, 13 Jul 2016 14:09:02 -0700 (PDT) Received: from mail-vk0-x22c.google.com (mail-vk0-x22c.google.com [IPv6:2607:f8b0:400c:c05::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 564AF12D8EE for ; Wed, 13 Jul 2016 14:09:02 -0700 (PDT) Received: by mail-vk0-x22c.google.com with SMTP id j126so29192505vkg.3 for ; Wed, 13 Jul 2016 14:09:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to; bh=3r2sANEoQShAU0ufYGYjAmlsyFWfSHKIUBlmB44c4x0=; b=Nn/laXufYfNJJkkVI2FW7dtPbnAGQeSWfZM5GhZhEJaKkXenokRGGf9HfH4mnm2hHY txqlPHaOTt4ioMLYDgpBOzkv/l7a2K8IkPQPP/t8pPVuFOkUrMHzJvi9bhMT5eXn30j5 ATWX/jKj/kp9J4h8Pq42Vb0xccS/5EKwPVS+iCrGAAI+NeTMNrSYRA6eaRiI9f4T1V1q IIgGG2wzBMvlCdM6WUZy+8mscqR5qPK11UHk3BW+0WF8B0jqLT2s0skff4jS2I8OhktV Ic8r7ZLDK4gv5SaDHem0GtSwaovFkK7ppc8SUVGEaC+qcoX78hvwxh3Ua7toZIruO+t+ cdhQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to; bh=3r2sANEoQShAU0ufYGYjAmlsyFWfSHKIUBlmB44c4x0=; b=SdTFwkhELVe8hQ/5nHa7JD0EBINi9Fw32SDDQqur+/TrZwlsLhlSAq6X7J97WfbnkA no93ueTHFQhBQef4N6NDN7RYbflQykeO++RG+Y+g1iSSmef+VbUSKKC1y7NALfTcAzd5 YfUZ1QT+29yGmmCqKL21UlblPtUi1Wcyo+LuCqLAvKewmxmF3PNKhEHycXrjOlpRIhms JFAxbRrMY/YsgxLhCg2kPWxnEmK+7FhDvt37z/5OdUuw/ZlX9hTByBCc6EwtlNPgQHKN UDX0pTLJCY7ro9AWu1qPUw/XMXyGiJGlgia+NZcGlCYc7kEsSArXCwe2/LqqazRLfaIF ljTA== X-Gm-Message-State: ALyK8tI1HZnGwJj+0jaT1YI/hXfrsblF0CqyDj+IPD5IU7gvRGXAb0Z1vFdJpiH6lwg6ZCS7a1uELf1if7An2A== X-Received: by 10.31.107.146 with SMTP id k18mr4171448vki.35.1468444141338; Wed, 13 Jul 2016 14:09:01 -0700 (PDT) MIME-Version: 1.0 Received: by 10.159.33.150 with HTTP; Wed, 13 Jul 2016 14:09:00 -0700 (PDT) In-Reply-To: References: From: J Braunberger Date: Wed, 13 Jul 2016 14:09:00 -0700 Message-ID: To: IETF STIR Mail List Content-Type: multipart/alternative; boundary=001a114783cc6ac7c405378acb2b Archived-At: Subject: Re: [stir] WG Last Call for STIR Certificates Document X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Jul 2016 21:09:04 -0000 --001a114783cc6ac7c405378acb2b Content-Type: text/plain; charset=UTF-8 Just found a few proofreading things for cleanup... - page 3, 2nd last paragraph, 2nd last line: s/taht/that/ - page 8, section 7, near end of 1st paragraph, the phrase before the "," seems incomplete "[I-D.ietf-stir-rfc4474bis] provides an "info" parameter of the Identity header which contains a URI where the credential used to generate the Identity header, and requires documents which define credential systems to list the URI schemes that may be present in the "info" parameter." - page 9, section 8, near end of 1st paragraph: "TN Authorization List extension particular is to allow a verifier to" - should it be "in particular"? - page 10, section 3, last sentence: should be "a future version" or "future versions" - page 10, section 9, last sentence on page: s/that/than/ - page 11, section 9.1, last paragraph: s/relying/relied/ - page 13, section 9.2.1, 2nd paragraph, 2nd sentence: s/signlerequestExtensions/singleRequestExtensions/ - page 13, first bullet: s/Sectin/Section/ also, "of as per in" - a little awkward? - page 14, section 9.3, last sentence: "A verifier would then follow the URI to ascertain whether the list of TNs authorized for use by the caller." - incomplete sentence? - page 15, 2nd line: s/number/numbers/ John Braunberger On Wed, Jul 13, 2016 at 12:43 PM, Russ Housley wrote: > The authors of the STIR Certificates document > (https://www.ietf.org/id/draft-ietf-stir-certificates-07.txt) > have stated that the document is mature and ready for WG Last Call. > > This message starts a two week WG Last Call for the STIR Certificates > document, which will end on 27 July 2016. Ideally major concerns > will be raised quickly so that they can be tackled during IETF 96. > > Please review the document and send comments on it to the STIR WG > mail list. Please clearly state your opinion as to whether the > document is ready for publication as a standards-track RFC. > Remember that support for publication is needed. > > Thanks, > Russ & Robert > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir > --001a114783cc6ac7c405378acb2b Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Just found a few proofreading things for cleanup...
=C2=A0 =C2=A0 =C2=A0- page 3, 2nd last paragraph, 2nd last lin= e: =C2=A0s/taht/that/

=C2=A0 =C2=A0 =C2=A0- page 8= , section 7, near end of 1st paragraph, the phrase before the ","= seems incomplete
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0"[I-D.ietf-stir-rfc4474bis] provides an "= info" parameter of the
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Identity header which contains a URI whe= re the credential used to
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 generate the Identity header, and requires = documents which define
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0credential systems to list the URI schemes that = may be present in the
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0"info" parameter."
=C2= =A0 =C2=A0 =C2=A0- page 9, section 8, near end of 1st paragraph: =C2=A0&quo= t;TN Authorization List extension particular is to allow a verifier to"= ; - should it be "in particular"?
=C2=A0 =C2=A0 =C2=A0-= page 10, section 3, last sentence: =C2=A0should be "a future version&= quot; or "future versions"
=C2=A0 =C2=A0 =C2=A0- page 1= 0, section 9, last sentence on page: =C2=A0s/that/than/
=C2=A0 = =C2=A0 =C2=A0- page 11, section 9.1, last paragraph: =C2=A0s/relying/relied= /
=C2=A0 =C2=A0 =C2=A0- page 13, section 9.2.1, 2nd paragraph, 2n= d sentence: =C2=A0s/signlerequestExtensions/singleRequestExtensions/
<= div>=C2=A0 =C2=A0 =C2=A0- page 13, first bullet: =C2=A0s/Sectin/Section/
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 also, &q= uot;of as per in" - a little awkward?
=C2=A0 =C2=A0 =C2=A0- = page 14, section 9.3, last sentence: =C2=A0"A verifier would then foll= ow the URI to ascertain whether the list of TNs authorized for use by the c= aller." -
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0incomplete sentence?
=C2=A0 =C2=A0 =C2=A0- pa= ge 15, 2nd line: =C2=A0 s/number/numbers/

John Bra= unberger

On Wed, Jul 13, 2016 at 12:43 PM, Russ Housley <housley@vigilsec.com= > wrote:
The authors of the= STIR Certificates document
(https://www.ietf.org/id/draft-ietf-stir-= certificates-07.txt)
have stated that the document is mature and ready for WG Last Call.

This message starts a two week WG Last Call for the STIR Certificates
document, which will end on 27 July 2016.=C2=A0 Ideally major concerns
will be raised quickly so that they can be tackled during IETF 96.

Please review the document and send comments on it to the STIR WG
mail list.=C2=A0 Please clearly state your opinion as to whether the
document is ready for publication as a standards-track RFC.
Remember that support for publication is needed.

Thanks,
Russ & Robert

_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir

--001a114783cc6ac7c405378acb2b-- From nobody Wed Jul 13 14:25:43 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D209912D614 for ; Wed, 13 Jul 2016 14:25:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.9 X-Spam-Level: X-Spam-Status: No, score=-101.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z1AHfW5F2u8u for ; Wed, 13 Jul 2016 14:25:40 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1E12512D597 for ; Wed, 13 Jul 2016 14:25:40 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 0D7A93004EF for ; Wed, 13 Jul 2016 17:25:38 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id DP_ePgWsy-46 for ; Wed, 13 Jul 2016 17:25:37 -0400 (EDT) Received: from [192.168.2.100] (pool-108-51-128-219.washdc.fios.verizon.net [108.51.128.219]) by mail.smeinc.net (Postfix) with ESMTPSA id 06070300429 for ; Wed, 13 Jul 2016 17:25:36 -0400 (EDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) From: Russ Housley In-Reply-To: Date: Wed, 13 Jul 2016 17:24:50 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: <7CEFB346-DB2B-4130-A636-FB2B6CFD344D@vigilsec.com> References: To: IETF STIR Mail List X-Mailer: Apple Mail (2.1878.6) Archived-At: Subject: Re: [stir] WG Last Call for RFC4474bis X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Jul 2016 21:25:42 -0000 I think the document should go forward, but please remove the reference = to RFC 6919. Russ On Jul 13, 2016, at 3:58 PM, Russ Housley wrote: >=20 > The authors of the Authenticated Identity Management in SIP document > (https://www.ietf.org/id/draft-ietf-stir-rfc4474bis-10.txt) have > stated that the document is mature and ready for WG Last Call. >=20 > This message starts a two week WG Last Call for that document, which > will end on 27 July 2016. Ideally major concerns will be raised > quickly so that they can be tackled during IETF 96. >=20 > Please review the document and send comments on it to the STIR WG > mail list. Please clearly state your opinion as to whether the > document is ready for publication as a standards-track RFC. > Remember that support for publication is needed. >=20 > Thanks, > Russ & Robert >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir From nobody Thu Jul 14 04:50:04 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C56CE128B44 for ; Thu, 14 Jul 2016 04:50:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lvEbN1ryehZm for ; Thu, 14 Jul 2016 04:50:01 -0700 (PDT) Received: from smtp7.webway.se (smtp7.webway.se [212.3.14.205]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4EA8912B01D for ; Thu, 14 Jul 2016 04:50:00 -0700 (PDT) Received: from [192.168.40.18] (h87-96-134-129.cust.se.alltele.net [87.96.134.129]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp7.webway.se (Postfix) with ESMTPSA id 5691842E3; Thu, 14 Jul 2016 13:49:57 +0200 (CEST) From: "Olle E. Johansson" Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Thu, 14 Jul 2016 13:49:56 +0200 Message-Id: To: stir@ietf.org Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) X-Mailer: Apple Mail (2.3124) Archived-At: Cc: Olle E Johansson Subject: [stir] Comments on draft-jennings-stir-rfc4474bis-10 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Jul 2016 11:50:04 -0000 Hi! I=E2=80=99ve been reading this draft and have a few nits and some = general comments below. Section 3 - Maybe add subparagraphs for SIP URI=E2=80=99s and telephone numbers. = It=E2=80=99s a very long section. -=20 =E2=80=9CThe authentication service then computes a signature over those JSON object in a manner following PASSporT.=E2=80=9D s/those/that/ - =E2=80=9CThat signature is then placed in a SIP Identity header. = =E2=80=9C I assume both signature and JSON object? - =E2=80=9CIn these cases, implementation the authentication service at = an intermediary may be more practical.=E2=80=9D s/implementation/implementing/ Section 5.1 - =E2=80=9CThe procedures below define the steps that must be taken when = each an header is added.=E2=80=9D s/an // Section 5.1 step 4 - =E2=80=9CSubsequently, the authentication service MUST form a = PASSporT object and add a corresponding an Identity header to the request containing this signature.=E2=80=9D s/an Identity/Identity/ Section 5.1 step 5 - =E2=80=9CFinally, the authentication service MUST forward the = message normally.=E2=80=9D What is normal? Section 5.2: - =E2=80=9CIf the verifier does not support an Identity header present in a request due to the presence of an unsupported "ppt" parameter, or if no Identity header is present, and the presence of an Identity header is required by local policy (for example, based on a per-sending-domain policy, or a per-sending-user policy), then a 428 'Use Identity Header' response MUST be sent in the backwards direction. =E2=80=9C It seems that the reason text used here doesn=E2=80=99t match the = problem. If there is an identity header with an unsupported parameter - should this message not be conveyed back either in the response code or in an additional header, like a warning code saying =E2=80=9Cunsupported = ppt param=E2=80=9D. Section 5.2 Step 1: - =E2=80=9CThe verifier MUST inspect any optional "ppt" = parameter appearing the Identity request.=E2=80=9D s/appearing/appearing in / Step 4: - Does not describe actions to take if the date is outside of the = accepted range. Step 4: - =E2=80=9CThe handling of the message after the verification process depends on how the implementation service is implemented and on local policy.=E2=80=9D Do you really mean =E2=80=9Cimplementation service=E2=80=9D? Maybe = =E2=80=9Cverification service=E2=80=9D ? Section 5.2.1: - =E2=80=9CIf the optional "canon" parameter of the Identity header is = present, it contains a base64 encoding of the header and claim component of the PASSporT object constructed by the authentication service, and this it conveys any canonical telephone number formats created by the authentication service (see Section 7.2), as well as an "iat" claim corresponding to the Date header that the authentication service used.=E2=80=9D The phrase =E2=80=9Cthis it=E2=80=9D seems wrong to me, maybe you mean = =E2=80=9Cthus it=E2=80=9D Section 6.2: - =E2=80=9CProvided that the credential used to sign a message is not previously known to the verifier, SIP entities SHOULD discover this credential by dereferencing the "info" parameter, unless they have some more other implementation-specific way of acquiring the needed keying material, such as an offline store of periodically-updated credentials.=E2=80=9D =E2=80=9Csome more other=E2=80=9D seems like you have one word too many.=20= Section 6.3 - =E2=80=9CFor example, imagine a case where a domain implements the authentication service role for a range of telephone and a user agent belonging to Alice has acquired a credential for a single telephone number within that range. =E2=80=9C Range of telephone WHAT? Numbers? Section 7: - =E2=80=9CUltimately, in any case where local policy canonicalizes the = idenity=E2=80=9D .. - s/idenity/identity/ Section 7.3 - =E2=80=9Cdomain signature=E2=80=9D is not explained - I don=E2=80=99t really like the last paragraph. In RFC 5922 SIP Domain = Certificates wildcard certificates are banned, which is not the case in = RFC 2818. 5922 seems to me a better reference, especially if we want to = be able to use the same certificate and keys. RFC 6125 section 6.4. is = also a bit more up to date on verification of domain names in certs. Section 7.4 - s/ayntax/syntax/ - I would add a notice that the username part is case-sensitive and = should not be normalised, which is not the case with domains in the SIP = uri. A not about internationalised domain names would also be good for = implementers since you mention international environments. Section 11: - =E2=80=9CSimilar practices could be used to support opportunistic signing of SIP requests for UA-integrated authentications services with self-signed certificates, though that is outside the scope of this specification and is left as a matter for future = investigation.=E2=80=9D s/authentications/authentication/ - The first reference to RFC3325 seems to lack a link in the HTML = version: =E2=80=9C[RFC3325] defines the "id" priv-value token, which is = specific to the P-Asserted-Identity header.=E2=80=9D Section 12.4: - In a scenario with Outbound Edge proxies - would the requirement of a = direct TLS connection in 12.4 require that the authentication service is = placed on the edge proxies? I would say it is natural to place it in the = registrar/auth service beyond the edge proxies, but then this = requirement fails. Section 12.5 - The first paragraph claims it is RECOMMENDED to employ strong = authentication practises. Section 5 claims it is a MUST. Some general comments - I think the document would benefit from a few definitions of terms = used in the beginning, as it suffers from a chicken and egg problem. A = lot of terms is used before they are explained. - It is unclear how identity headers should be handled by a b2bua, = especially when media keying is included in the signature=E2=80=A6 That = may be for discussion somewhere else, but is something I expect will = come up. b2bua=E2=80=99s may be able to forward Identity headers but = typically wants to anchor media streams. It is has been discussed that = discussion is not documented in the document. - Can we do this without referring to the SIPS: uri scheme? I am not = happy seeing this uri scheme turn up in new documents. /Olle From nobody Thu Jul 14 14:24:27 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C0E2E12D869 for ; Thu, 14 Jul 2016 14:24:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.6 X-Spam-Level: X-Spam-Status: No, score=-102.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AfbhOGSXgm4r for ; Thu, 14 Jul 2016 14:24:23 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0a-0018ba01.pphosted.com [67.231.149.94]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A5FF812D82A for ; Thu, 14 Jul 2016 14:24:22 -0700 (PDT) Received: from pps.filterd (m0078666.ppops.net [127.0.0.1]) by mx0a-0018ba01.pphosted.com (8.16.0.17/8.16.0.17) with SMTP id u6ELMnp5024750; Thu, 14 Jul 2016 17:24:18 -0400 Received: from stntexhc10.cis.neustar.com ([156.154.17.216]) by mx0a-0018ba01.pphosted.com with ESMTP id 242wcqhhaa-1 (version=TLSv1 cipher=AES128-SHA bits=128 verify=NOT); Thu, 14 Jul 2016 17:24:18 -0400 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.94]) by stntexhc10.cis.neustar.com ([169.254.4.225]) with mapi id 14.03.0279.002; Thu, 14 Jul 2016 17:24:17 -0400 From: "Peterson, Jon" To: Chris Wendt Thread-Topic: [stir] a syntax change Thread-Index: AQHR2W7bzsTobHl6sEOOeZEJkt6dxqATONnwgAAE6VuAAQEyAIAECBUA Date: Thu, 14 Jul 2016 21:24:16 +0000 Message-ID: References: <7594FB04B1934943A5C02806D1A2204B476855E5@ESESSMB208.ericsson.se> <2EF2D1DC-A510-42A8-BAA9-C2058F9EA782@neustar.biz> <96FA6E44-83FF-41B1-A8C3-63620B813937@chriswendt.net> In-Reply-To: <96FA6E44-83FF-41B1-A8C3-63620B813937@chriswendt.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.6.3.160329 x-originating-ip: [10.96.12.50] Content-Type: multipart/alternative; boundary="_000_D3AD4D531A61E9jonpetersonneustarbiz_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-07-14_12:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1607140227 Archived-At: Cc: IETF STIR Mail List , Christer Holmberg Subject: Re: [stir] a syntax change X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Jul 2016 21:24:25 -0000 --_000_D3AD4D531A61E9jonpetersonneustarbiz_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Well, many of the same B2BUAs that today alter the Date header surely strip= the Identity header as well, as they strip virtually any header that is no= t specifically authorized. There is a certain amount we can and should do t= o accommodate such devices, but its a two-way street - reconfiguring such d= evices to accept Identity while still munging Date might be counterproducti= ve. That much said, yes, rfc4474bis-10 certainly allows sending "canon" without= first receiving a 438. Maybe the answer is a deployment profile, as you su= ggest, for environments where it is known to be a problem. If that turns ou= t to be "all meaningful environments" well... then in time we migrate the b= ase standard in that direction. The point is, if it turned out that we alwa= ys needed "canon," then we should design the header in such a way that "can= on" isn't even a parameter, and just carry the raw PASSporT object. We shou= ld avoid options where we don't think they're useful, especially when it co= mes to security mechanisms. But until we're sure it isn't useful, I think t= he guidance we have now is what we should stick with. Jon Peterson Neustar, Inc. From: Chris Wendt > Date: Monday, July 11, 2016 at 5:50 PM To: Jon Peterson = > Cc: Christer Holmberg >, IETF STIR Mail List > Subject: Re: [stir] a syntax change Relevant to this topic, I think one other valid discussion point that we ma= y or may not have talked about on the list or face to face is how often we = think the date header will be changed in transit. The current rule is if signature verification fails a 438 is sent back and = the authentication service should sent the INVITE with an identity header w= ith canon parameter and the full token with the date explicitly included. If we believe the date header will be changed often, then we obviously don= =92t want a high percentage of SIP calls creating 438 errors to force new I= NVITES (or effectively sending INVITEs twice) Perhaps, for some real-world applications there is a low chance of a date h= eader change because the call path is fairly predictable, and the cases whe= re a 438 happens is very rare. Then favoring the current default is correc= t. But, for example, in situation where many B2BUAs are part of the applicatio= n, you may have a very decent chance that someone is going to change a date= header out of your control, we may want canon because sending the invite t= wice is more expensive than saving the header and claims bytes in the first= place. One approach is rely on industry SIP profile documents to define such thing= s to send =93canon=94 for every call. I don=92t think anything in 4474bis = prevents that, correct me if I=92m wrong Jon. The question I think would be good to get more input on is if date header c= hanges are more common or rare in most peoples operational experience. Thanks. -Chris On Jul 11, 2016, at 7:29 AM, Peterson, Jon > wrote: I don't think we took a formal consensus call, or what have you. What we di= d do though is to include in rfc4474bis a URI normalization procedure that = we hope will obviate the ambiguity about URI comparisons you raised. I still think the message size reduction is worth the complexity trade-off = to permit "canon" not to be included - and if it is allowed to be absent at= all, then I think by default it should be absent. Jon Peterson Neustar, Inc. Sent from my iPad On Jul 11, 2016, at 9:13 AM, Christer Holmberg > wrote: Hi, Some time ago there was a discussion whether we should include the claims t= o begin with, as the information can be retrieved from other SIP informatio= n elements. Did we make a conclusion on that? Regards, Christer From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Peterson, Jon Sent: 09 July 2016 02:17 To: IETF STIR Mail List > Subject: [stir] a syntax change Attentive readers will observed a syntax change in passport-04 which carrie= s over to rfc4744bis-10. Implementers, especially those looking forward to = the SIPit coming up, should take note. The change is to the claims of the PASSporT object. Rather than having two = different versions of each claim to reflect the originating and destination= side, such as "otn" and "dtn", there is now simply a "tn" claim. That clai= m will appear within a JSON array explicitly labeled as "orig" or "dest" in= the PASSporT object. This will result in PASSporT claims like the following: { "orig":{"tn":"12155551212"}, "dest":{"tn":"12155551213"}, "iat":"1443208345" } The "dest" claim is specifically defined to allow one or more values, so it= replaces the previous "dgrp" claim to be used in cases where a message has= multiple destinations. This eliminated the redundancy of having future extensions to the PASSporT = claims identify whether they carried an identifier for the originating or d= estination side. Now, new claim definitions simply have to state that they = contain identifiers: the semantics of the identifier will depend on whether= it appears under "orig" or "dest". In fact, PASSporT could probably work w= ith some existing JWT claims now that represent identifiers. This seemed li= ke a much better idea than the way we were doing it before. This was a fairly last-minute fix, but it didn't require much spec change a= nd is hopefully stable and consistent. Thoughts welcome. Jon Peterson Neustar, Inc. _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir --_000_D3AD4D531A61E9jonpetersonneustarbiz_ Content-Type: text/html; charset="Windows-1252" Content-ID: <1E7C6C4D87778044B812C5BE190CC1B9@neustar.biz> Content-Transfer-Encoding: quoted-printable

Well, many of the same B2BUAs that today alter the Date header surely = strip the Identity header as well, as they strip virtually any header that = is not specifically authorized. There is a certain amount we can and should= do to accommodate such devices, but its a two-way street - reconfiguring such devices to accept Identity w= hile still munging Date might be counterproductive.

That much said, yes, rfc4474bis-10 certainly allows sending "cano= n" without first receiving a 438. Maybe the answer is a deployment pro= file, as you suggest, for environments where it is known to be a problem. I= f that turns out to be "all meaningful environments" well... then in time we migrate the base standard in that direction. The p= oint is, if it turned out that we always needed "canon," then we = should design the header in such a way that "canon" isn't even a = parameter, and just carry the raw PASSporT object. We should avoid options where we don't think they're useful, especially when = it comes to security mechanisms. But until we're sure it isn't useful, I th= ink the guidance we have now is what we should stick with.

Jon Peterson
Neustar, Inc.

From: Chris Wendt <chris-ietf@chriswendt.net>
Date: Monday, July 11, 2016 at 5:50= PM
To: Jon Peterson <jon.peterson@neustar.biz>
Cc: Christer Holmberg <christer.holmberg@ericsson.com>, IETF STIR Mail List <stir@ietf.= org>
Subject: Re: [stir] a syntax change=

Relevant to this topic, I think one other valid discussion point that we ma= y or may not have talked about on the list or face to face is how often we = think the date header will be changed in transit.

The current rule is if signature verification fails a 438 i= s sent back and the authentication service should sent the INVITE with an i= dentity header with canon parameter and the full token with the date explic= itly included.

If we believe the date header will be changed often, then w= e obviously don=92t want a high percentage of SIP calls creating 438 errors= to force new INVITES (or effectively sending INVITEs twice)

Perhaps, for some real-world applications there is a low ch= ance of a date header change because the call path is fairly predictable, a= nd the cases where a 438 happens is very rare.  Then favoring the curr= ent default is correct.  

But, for example, in situation where many B2BUAs are part o= f the application, you may have a very decent chance that someone is going = to change a date header out of your control, we may want canon because send= ing the invite twice is more expensive than saving the header and claims bytes in the first place.

One approach is rely on industry SIP profile documents to d= efine such things to send =93canon=94 for every call.  I don=92t think= anything in 4474bis prevents that, correct me if I=92m wrong Jon.

The question I think would be good to get more input on is = if date header changes are more common or rare in most peoples operational = experience. 

Thanks.

-Chris

On Jul 11, 2016, at 7:29 AM, Peterson, Jon <jon.peterson@neustar.biz>= wrote:


I don't think we took a formal consensus call, or what have you. What we di= d do though is to include in rfc4474bis a URI normalization procedure that = we hope will obviate the ambiguity about URI comparisons you raised. <= /div>

I still think the message size reduction is worth the complexity trade-off = to permit "canon" not to be included - and if it is allowed to be= absent at all, then I think by default it should be absent. 

Jon Peterson
Neustar, Inc.

Sent from my iPad

On Jul 11, 2016, at 9:13 AM, Christer Holmberg <christer.holmberg@ericsson.com> wrote:

Hi,
 
Some time ago there was a discussion whether we= should include the claims to begin with, as the information can be retriev= ed from other SIP information elements.
 
Did we make a conclusion on that?
 
Regards,
 
Christer
 
From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Peterson, = Jon
Sent: 0= 9 July 2016 02:17
To: IET= F STIR Mail List <stir@ietf.org>=
Subject: [stir] a syntax change
 
 
Attentive readers will observed a syntax change in passport-04 which = carries over to rfc4744bis-10. Implementers, especially those looking forwa= rd to the SIPit coming up, should take note.
 
The change is to the claims of the PASSporT object. Rather than havin= g two different versions of each claim to reflect the originating and desti= nation side, such as "otn" and "dtn", there is now simply a "tn" claim. That claim will appear within = a JSON array explicitly labeled as "orig" or "dest" in = the PASSporT object. 
 
This will result in PASSporT claims like the following:
 
 =
;     { "orig":{"tn":"12155551=
212"},
    &=
nbsp;   "dest":{"tn":"12155551213"}=
,
    &=
nbsp;   "iat":"1443208345" }<=
/o:p>
 
The "dest" claim is specifically defined to allow one or mo= re values, so it replaces the previous "dgrp" claim to be used in= cases where a message has multiple destinations.
 
This eliminated the redundancy of having future extensions to the PAS= SporT claims identify whether they carried an identifier for the originatin= g or destination side. Now, new claim definitions simply have to state that they contain identifiers: the semant= ics of the identifier will depend on whether it appears under "orig&qu= ot; or "dest". In fact, PASSporT could probably work with some ex= isting JWT claims now that represent identifiers. This seemed like a much better idea than the way we were doing it before.
 
This was a fairly last-minute fix, but it didn't require much spec ch= ange and is hopefully stable and consistent. Thoughts welcome.
 
Jon Peterson
Neustar, Inc.
 
 
______________= _________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/ma= ilman/listinfo/stir

 --_000_D3AD4D531A61E9jonpetersonneustarbiz_-- From nobody Thu Jul 14 14:44:51 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4E4B112D660 for ; Thu, 14 Jul 2016 14:44:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nNCgDeLZ_-yb for ; Thu, 14 Jul 2016 14:44:47 -0700 (PDT) Received: from mail-qt0-x22a.google.com (mail-qt0-x22a.google.com [IPv6:2607:f8b0:400d:c0d::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D1DB512D586 for ; Thu, 14 Jul 2016 14:44:45 -0700 (PDT) Received: by mail-qt0-x22a.google.com with SMTP id u25so49964881qtb.1 for ; Thu, 14 Jul 2016 14:44:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=mime-version:subject:from:in-reply-to:date :content-transfer-encoding:message-id:references:to; bh=NcpnlQY0mOUbEh5Y17b630x3W6MSvV6fJ/aYj71uibU=; b=OTD4yn8HF3SHmNHO9U3QfU0O8dx78Ms7I+ZT6fWeOB95IQt7Nu2T7xMWDXTsO8ZVT8 cOrkDGNiRMVnFt5HDC9TuchlFcU1KHGpLrp5o5Eknpd6cOtjGAFTdRa76pTsiDpOOW3W DGkD3ir8P0uUIAoG4rr2js2u/Fe7ZpCc4ryIM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date :content-transfer-encoding:message-id:references:to; bh=NcpnlQY0mOUbEh5Y17b630x3W6MSvV6fJ/aYj71uibU=; b=UpnG5d21aW5EwcfYgdQWN49jmZIKiteQJz0QtwuxRu2ktELi1EUxX/ZuV38unpuOYx 0pij6FIDv0prEXbo5r+nCLAKY7cYy9fg/cnCqYQIu29BkmH2MzMMXRL2coUr311fjfup WsVfO3B8U7DmLbxmF6J+LAq57L39/Cf+lOpW4mr5nffE9I0el2P3rZfc0TbfIymgbNt0 0Duf5zwDzs4s8asP7espUzUoLiYg7c++CQkNizIrhTgKVrSe5XxK2oljnq0doU3UgSGA lWlzhswA5Ilf7ErRgxn23KEnc7huNSPTm9h5q4d5eUwQYEWiIP4Iyvfegqk7ccmYb35W 0dVg== X-Gm-Message-State: ALyK8tIiOmUHgZwYCGAi/aW1tZGM1GjqktDZfV8aNrQ91WD24cXeGq1nKB8Nfw83oF4/rQ== X-Received: by 10.237.52.101 with SMTP id w92mr24812994qtd.51.1468532684782; Thu, 14 Jul 2016 14:44:44 -0700 (PDT) Received: from [172.16.0.112] ([96.231.230.69]) by smtp.gmail.com with ESMTPSA id k54sm2019313qtk.44.2016.07.14.14.44.43 for (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Thu, 14 Jul 2016 14:44:44 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Sean Turner In-Reply-To: <3A38E008-748D-450A-8A58-A08EF4C972C8@att.com> Date: Thu, 14 Jul 2016 17:44:42 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: References: <3A38E008-748D-450A-8A58-A08EF4C972C8@att.com> To: stir@ietf.org X-Mailer: Apple Mail (2.3124) Archived-At: Subject: Re: [stir] Consensus Call Regarding Early Codepoint Allocation X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Jul 2016 21:44:49 -0000 I do as well, but then again I requested them so I=E2=80=99m a little = biased. spt > On Jul 13, 2016, at 15:25, DOLLY, MARTIN C wrote: >=20 > I support early code point allocation >=20 > Regards >=20 > Martin C Dolly > Lead Member of Technical Staff > Core & Government/Regulatory Standards=20 > AT&T > Cell: 609-903-3360 > Email: md3135@att.com >=20 >> On Jul 13, 2016, at 3:20 PM, Russ Housley = wrote: >>=20 >> The STIR Certificates document (draft-ietf-stir-certificates-07.txt) >> calls for IANA to allocation four codepoints: >>=20 >> o TN Certificate Extension in the SMI Security for PKIX Certificate >> Extension registry: http://www.iana.org/assignments/smi-numbers/ >> smi-numbers.xhtml#smi-numbers-1.3.6.1.5.5.7.1 >>=20 >> o TN-HVE OCSP extension in the SMI Security for PKIX Online >> Certificate Status Protocol (OCSP) registry: >> = http://www.iana.org/assignments/smi-numbers/smi-numbers.xhtml#smi- >> numbers-1.3.6.1.5.5.7.48.1 >>=20 >> o TNS by reference access descriptor in the SMI Security for PKIX >> Access Descriptor registry: http://www.iana.org/assignments/smi- >> numbers/smi-numbers.xhtml#smi-numbers-1.3.6.1.5.5.7.48 >>=20 >> o The TN ASN.1 module in SMI Security for PKIX Module Identifier >> registry: http://www.iana.org/assignments/smi-numbers/smi- >> numbers.xhtml#smi-numbers-1.3.6.1.5.5.7.0=20 >>=20 >> The document authors have requested that IANA perform an early >> allocation of these codepoints. Consensus of the STIR WG is needed >> for the IESG to request early allocation. >>=20 >> Please let us know whether you support early codepoint allocation. >>=20 >> Thanks, >> Russ >>=20 >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir From nobody Thu Jul 14 15:45:37 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1CD4412D8F8 for ; Thu, 14 Jul 2016 15:45:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.22 X-Spam-Level: X-Spam-Status: No, score=-4.22 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0fDKhE5gD_mZ for ; Thu, 14 Jul 2016 15:45:33 -0700 (PDT) Received: from sesbmg23.ericsson.net (sesbmg23.ericsson.net [193.180.251.37]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E158E12D63B for ; Thu, 14 Jul 2016 15:45:31 -0700 (PDT) X-AuditID: c1b4fb25-f79f26d00000327e-5a-57881609018d Received: from ESESSHC003.ericsson.se (Unknown_Domain [153.88.183.27]) by sesbmg23.ericsson.net (Symantec Mail Security) with SMTP id 00.40.12926.90618875; Fri, 15 Jul 2016 00:45:29 +0200 (CEST) Received: from ESESSMB208.ericsson.se ([169.254.8.19]) by ESESSHC003.ericsson.se ([153.88.183.27]) with mapi id 14.03.0294.000; Fri, 15 Jul 2016 00:45:29 +0200 From: Christer Holmberg To: IETF STIR Mail List Thread-Topic: Separation of JWS Thread-Index: AdHeH9SEjAwkAAZ1QgeK8BCIvyVBJQ== Date: Thu, 14 Jul 2016 22:45:29 +0000 Message-ID: <7594FB04B1934943A5C02806D1A2204B476AAFB0@ESESSMB208.ericsson.se> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [153.88.183.154] Content-Type: multipart/alternative; boundary="_000_7594FB04B1934943A5C02806D1A2204B476AAFB0ESESSMB208erics_" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrILMWRmVeSWpSXmKPExsUyM2K7tC6nWEe4wbt/phbL125jcmD0WLLk J1MAYxSXTUpqTmZZapG+XQJXxrt1R1kLVshX7Fq9m7mBcYF0FyMHh4SAicSrnQ5djJxAppjE hXvr2boYuTiEBI4wSnyY9oAJwlnMKNE55TUzSAObgIVE9z9tkAYRAXWJ1rY+ZhBbWEBK4sPl uewQcXmJdRdPs0DYehJ7nywEi7MIqEr8ONTFCGLzCvhKnF08iRXEZgRa/P3UGiYQm1lAXOLW k/lMEAcJSCzZc54ZwhaVePn4HyuErSSx6PZnqPp8iY9zXjNDzBSUODnzCcsERqFZSEbNQlI2 C0kZRFxHYsHuT2wQtrbEsoUQNSD2mQOPmZDFFzCyr2IULU4tTspNNzLWSy3KTC4uzs/Ty0st 2cQIjIiDW36r7mC8/MbxEKMAB6MSD6/C5fZwIdbEsuLK3EOMEhzMSiK870U6woV4UxIrq1KL 8uOLSnNSiw8xSnOwKInz+r9UDBcSSE8sSc1OTS1ILYLJMnFwSjUwFp0RDDpa5fV1t03IU0vR 9r3iKQ+mOVzuMvH33Lqd1YuFzydNlMcn5axsQkZ7d9X2/8q7Ps9j+SQtUL2y6qid/pO1l1d5 yeRrn1oXKMcYMVv06ZRr975XZcRZiLgdXNl+s2Ix55o7L9gkH+p+bQzoqP3Ot+92GtNa6+pX 6hqsduuvPY8KW75diaU4I9FQi7moOBEALUsi/oQCAAA= Archived-At: Subject: [stir] Separation of JWS X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Jul 2016 22:45:35 -0000 --_000_7594FB04B1934943A5C02806D1A2204B476AAFB0ESESSMB208erics_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi, Perhaps the following has been discussed before, but I did not find the rea= son in draft-4474bis. Why is the JWS signature "separated" from the headers and claims within the= Identity header field? The signature is sent as the Identity header field = value, while the headers and claims are sent as the "canon" header field pa= rameter value. That's now how JWS is defined, as far as I understand. Everything is sent a= s one string (with the different parts separated by "."). Why isn't everything sent as the Identity header field value? That does not= prevent you from e.g. not sending the claims. Regards, Christer --_000_7594FB04B1934943A5C02806D1A2204B476AAFB0ESESSMB208erics_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi,

 

Perhaps the following has been discussed before, but= I did not find the reason in draft-4474bis.

 

Why is the JWS signature “separated” fro= m the headers and claims within the Identity header field? The signature is= sent as the Identity header field value, while the headers and claims are = sent as the “canon” header field parameter value.

 

That’s now how JWS is defined, as far as I und= erstand. Everything is sent as one string (with the different parts separat= ed by “.”).

 

Why isn’t everything sent as the Identity head= er field value? That does not prevent you from e.g. not sending the claims.=

 

Regards,

 

Christer

--_000_7594FB04B1934943A5C02806D1A2204B476AAFB0ESESSMB208erics_-- From nobody Thu Jul 14 16:36:04 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 908A912D1B1 for ; Thu, 14 Jul 2016 16:36:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.9 X-Spam-Level: X-Spam-Status: No, score=-101.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AkFuzyQJne8l for ; Thu, 14 Jul 2016 16:36:00 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6B0A012D110 for ; Thu, 14 Jul 2016 16:36:00 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 378A1300568 for ; Thu, 14 Jul 2016 19:35:58 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id yOj04oftfWaP for ; Thu, 14 Jul 2016 19:35:56 -0400 (EDT) Received: from [192.168.2.100] (pool-108-51-128-219.washdc.fios.verizon.net [108.51.128.219]) by mail.smeinc.net (Postfix) with ESMTPSA id 37877300090; Thu, 14 Jul 2016 19:35:56 -0400 (EDT) Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) From: Russ Housley In-Reply-To: Date: Thu, 14 Jul 2016 19:35:56 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: <9815AE1D-6FFB-487A-B40D-BB2FE83E22B3@vigilsec.com> References: To: "Olle E. Johansson" X-Mailer: Apple Mail (2.1878.6) Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] Comments on draft-jennings-stir-rfc4474bis-10 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Jul 2016 23:36:02 -0000 Did you mean draft-ietf-stir-rfc4474bis-10? On Jul 14, 2016, at 7:49 AM, Olle E. Johansson wrote: > Hi! > I=92ve been reading this draft and have a few nits and some general = comments below. >=20 > Section 3 > - Maybe add subparagraphs for SIP URI=92s and telephone numbers. It=92s = a very long section. > -=20 > =93The authentication service then computes a signature over > those JSON object in a manner following PASSporT.=94 >=20 > s/those/that/ > - =93That signature is then placed in a SIP Identity header. =93 > I assume both signature and JSON object? >=20 > - =93In these cases, implementation the authentication service at an > intermediary may be more practical.=94 > s/implementation/implementing/ >=20 > Section 5.1 > - =93The procedures below define the steps that must be taken when = each an > header is added.=94 > s/an // >=20 > Section 5.1 step 4 > - =93Subsequently, the authentication service MUST form a = PASSporT object > and add a corresponding an Identity header to the request containing > this signature.=94 > s/an Identity/Identity/ >=20 > Section 5.1 step 5 > - =93Finally, the authentication service MUST forward the = message > normally.=94 > What is normal? >=20 > Section 5.2: > - =93If the verifier does not support > an Identity header present in a request due to the presence of an > unsupported "ppt" parameter, or if no Identity header is present, = and > the presence of an Identity header is required by local policy (for > example, based on a per-sending-domain policy, or a per-sending-user > policy), then a 428 'Use Identity Header' response MUST be sent in > the backwards direction. =93 >=20 > It seems that the reason text used here doesn=92t match the problem. > If there is an identity header with an unsupported parameter - should > this message not be conveyed back either in the response code or > in an additional header, like a warning code saying =93unsupported ppt = param=94. >=20 > Section 5.2 Step 1: > - =93The verifier MUST inspect any optional "ppt" parameter = appearing the > Identity request.=94 > s/appearing/appearing in / >=20 > Step 4: > - Does not describe actions to take if the date is outside of the = accepted range. >=20 > Step 4: > - =93The handling of the message after the > verification process depends on how the implementation service is > implemented and on local policy.=94 > Do you really mean =93implementation service=94? Maybe =93verification = service=94 ? >=20 > Section 5.2.1: > - =93If the optional "canon" parameter of the Identity header is = present, > it contains a base64 encoding of the header and claim component of > the PASSporT object constructed by the authentication service, and > this it conveys any canonical telephone number formats created by = the > authentication service (see Section 7.2), as well as an "iat" claim > corresponding to the Date header that the authentication service > used.=94 > The phrase =93this it=94 seems wrong to me, maybe you mean =93thus it=94= >=20 > Section 6.2: > - =93Provided that the credential used to sign a > message is not previously known to the verifier, SIP entities SHOULD > discover this credential by dereferencing the "info" parameter, > unless they have some more other implementation-specific way of > acquiring the needed keying material, such as an offline store of > periodically-updated credentials.=94 > =93some more other=94 seems like you have one word too many.=20 >=20 > Section 6.3 > - =93For example, > imagine a case where a domain implements the authentication service > role for a range of telephone and a user agent belonging to Alice = has > acquired a credential for a single telephone number within that > range. =93 > Range of telephone WHAT? Numbers? >=20 > Section 7: > - =93Ultimately, in any case where local policy canonicalizes the = idenity=94 .. > - s/idenity/identity/ >=20 > Section 7.3 > - =93domain signature=94 is not explained > - I don=92t really like the last paragraph. In RFC 5922 SIP Domain = Certificates wildcard certificates are banned, which is not the case in = RFC 2818. 5922 seems to me a better reference, especially if we want to = be able to use the same certificate and keys. RFC 6125 section 6.4. is = also a bit more up to date on verification of domain names in certs. > Section 7.4 > - s/ayntax/syntax/ > - I would add a notice that the username part is case-sensitive and = should not be normalised, which is not the case with domains in the SIP = uri. A not about internationalised domain names would also be good for = implementers since you mention international environments. > Section 11: > - =93Similar practices could be used to support opportunistic > signing of SIP requests for UA-integrated authentications services > with self-signed certificates, though that is outside the scope of > this specification and is left as a matter for future = investigation.=94 > s/authentications/authentication/ > - The first reference to RFC3325 seems to lack a link in the HTML = version: =93[RFC3325] defines the "id" priv-value token, which is = specific to the P-Asserted-Identity header.=94 >=20 > Section 12.4: > - In a scenario with Outbound Edge proxies - would the requirement of = a direct TLS connection in 12.4 require that the authentication service = is placed on the edge proxies? I would say it is natural to place it in = the registrar/auth service beyond the edge proxies, but then this = requirement fails. >=20 > Section 12.5 > - The first paragraph claims it is RECOMMENDED to employ strong = authentication practises. Section 5 claims it is a MUST. >=20 > Some general comments > - I think the document would benefit from a few definitions of terms = used in the beginning, as it suffers from a chicken and egg problem. A = lot of terms is used before they are explained. >=20 > - It is unclear how identity headers should be handled by a b2bua, = especially when media keying is included in the signature=85 That may be = for discussion somewhere else, but is something I expect will come up. = b2bua=92s may be able to forward Identity headers but typically wants to = anchor media streams. It is has been discussed that discussion is not = documented in the document. >=20 > - Can we do this without referring to the SIPS: uri scheme? I am not = happy seeing this uri scheme turn up in new documents. >=20 > /Olle >=20 >=20 >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir From nobody Thu Jul 14 16:44:32 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 32C5A12D63B for ; Thu, 14 Jul 2016 16:44:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.6 X-Spam-Level: X-Spam-Status: No, score=-102.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1htiqvMFGeiH for ; Thu, 14 Jul 2016 16:44:28 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0a-0018ba01.pphosted.com [67.231.149.94]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B28C412D580 for ; Thu, 14 Jul 2016 16:44:28 -0700 (PDT) Received: from pps.filterd (m0078666.ppops.net [127.0.0.1]) by mx0a-0018ba01.pphosted.com (8.16.0.17/8.16.0.17) with SMTP id u6ENX4EM009128; Thu, 14 Jul 2016 19:44:25 -0400 Received: from stntexhc10.cis.neustar.com ([156.154.17.216]) by mx0a-0018ba01.pphosted.com with ESMTP id 242wcqhy2f-1 (version=TLSv1 cipher=AES128-SHA bits=128 verify=NOT); Thu, 14 Jul 2016 19:44:24 -0400 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.94]) by stntexhc10.cis.neustar.com ([169.254.4.225]) with mapi id 14.03.0279.002; Thu, 14 Jul 2016 19:44:23 -0400 From: "Peterson, Jon" To: Christer Holmberg , IETF STIR Mail List Thread-Topic: [stir] Separation of JWS Thread-Index: AQHR3imlxQWCiaKHYkOkgu/OqfssDw== Date: Thu, 14 Jul 2016 23:44:23 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.6.3.160329 x-originating-ip: [10.96.12.50] Content-Type: multipart/alternative; boundary="_000_D3AD6E751A6268jonpetersonneustarbiz_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-07-14_15:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1607140252 Archived-At: Subject: Re: [stir] Separation of JWS X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Jul 2016 23:44:30 -0000 --_000_D3AD6E751A6268jonpetersonneustarbiz_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable This is partly the same question as we are exploring in the "syntax change"= thread discussion on whether or not "canon" will always be included. To answer your question, think about it as if SIP does not carry a JWS obje= ct, but instead it transports some data that allows a verification service = to generate a JWS object. So we're not "sending" the JWS object, and thus w= e're under no obligation to "send it as one string" or whatever. The rfc4474bis "canon" parameter optionally contains the encoded portion of= the header and claims of the JWS object because the headers (and claims) i= n baseline PASSporT are usually redundant wth the contents of a SIP request= - we anticipate that any verification service can ordinarily regenerate th= ose headers and claims itself, so, there's no ostensible value in carrying = them. Generally speaking, we should bloating messages with redundant fields= if we can. If you're asking why we chose to demarcate that with "canon" rather than ju= st not including the JWS header and claims if we didn't want to include the= JWS header and claims, it is generally better to be explicit than to leave= the verification service to infer what is going. Jon Peterson Neustar, Inc. From: stir > on behalf = of Christer Holmberg > Date: Thursday, July 14, 2016 at 3:45 PM To: IETF STIR Mail List > Subject: [stir] Separation of JWS Hi, Perhaps the following has been discussed before, but I did not find the rea= son in draft-4474bis. Why is the JWS signature =93separated=94 from the headers and claims within= the Identity header field? The signature is sent as the Identity header fi= eld value, while the headers and claims are sent as the =93canon=94 header = field parameter value. That=92s now how JWS is defined, as far as I understand. Everything is sent= as one string (with the different parts separated by =93.=94). Why isn=92t everything sent as the Identity header field value? That does n= ot prevent you from e.g. not sending the claims. Regards, Christer --_000_D3AD6E751A6268jonpetersonneustarbiz_ Content-Type: text/html; charset="Windows-1252" Content-ID: Content-Transfer-Encoding: quoted-printable

This is partly the same question as we are exploring in the "synt= ax change" thread discussion on whether or not "canon" will = always be included.

To answer your question, think about it as if SIP does not carry a JWS= object, but instead it transports some data that allows a verification ser= vice to generate a JWS object. So we're not "sending" the JWS obj= ect, and thus we're under no obligation to "send it as one string" or whatever.

The rfc4474bis "canon" parameter optionally contains the enc= oded portion of the header and claims of the JWS object because the headers= (and claims) in baseline PASSporT are usually redundant wth the contents o= f a SIP request - we anticipate that any verification service can ordinarily regenerate those headers and claims itself, so, the= re's no ostensible value in carrying them. Generally speaking, we should bl= oating messages with redundant fields if we can. 

If you're asking why we chose to demarcate that with "canon"= rather than just not including the JWS header and claims if we didn't want= to include the JWS header and claims, it is generally better to be explici= t than to leave the verification service to infer what is going.

Jon Peterson
Neustar, Inc.

From: stir <stir-bounces@ietf.org> on behalf of Christer Ho= lmberg <christer.holmb= erg@ericsson.com>
Date: Thursday, July 14, 2016 at 3:= 45 PM
To: IETF STIR Mail List <stir@ietf.org>
Subject: [stir] Separation of JWS

Hi,

 

Perhaps the following has been discussed before, but= I did not find the reason in draft-4474bis.

 

Why is the JWS signature =93separated=94 from the he= aders and claims within the Identity header field? The signature is sent as= the Identity header field value, while the headers and claims are sent as = the =93canon=94 header field parameter value.

 

That=92s now how JWS is defined, as far as I underst= and. Everything is sent as one string (with the different parts separated b= y =93.=94).

 

Why isn=92t everything sent as the Identity header f= ield value? That does not prevent you from e.g. not sending the claims.

 

Regards,

 

Christer

 --_000_D3AD6E751A6268jonpetersonneustarbiz_-- From nobody Thu Jul 14 17:11:36 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6F3C212D8E8 for ; Thu, 14 Jul 2016 17:11:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.601 X-Spam-Level: X-Spam-Status: No, score=-102.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8czN3QeLXquH for ; Thu, 14 Jul 2016 17:11:33 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0a-0018ba01.pphosted.com [67.231.149.94]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F0C1212D52C for ; Thu, 14 Jul 2016 17:11:32 -0700 (PDT) Received: from pps.filterd (m0078666.ppops.net [127.0.0.1]) by mx0a-0018ba01.pphosted.com (8.16.0.17/8.16.0.17) with SMTP id u6F03GH9028066; Thu, 14 Jul 2016 20:11:23 -0400 Received: from stntexhc10.cis.neustar.com ([156.154.17.216]) by mx0a-0018ba01.pphosted.com with ESMTP id 242wcqj1q9-1 (version=TLSv1 cipher=AES128-SHA bits=128 verify=NOT); Thu, 14 Jul 2016 20:11:22 -0400 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.94]) by stntexhc10.cis.neustar.com ([169.254.4.225]) with mapi id 14.03.0279.002; Thu, 14 Jul 2016 20:11:21 -0400 From: "Peterson, Jon" To: "Olle E. Johansson" , "stir@ietf.org" Thread-Topic: [stir] Comments on draft-jennings-stir-rfc4474bis-10 Thread-Index: AQHR3cXffQjpa+Kx406g74UufiuV2aAYbQ+A Date: Fri, 15 Jul 2016 00:11:20 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.6.3.160329 x-originating-ip: [10.96.12.50] Content-Type: text/plain; charset="Windows-1252" Content-ID: <6B7365663AFF174FB720BB3CE462B34B@neustar.biz> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-07-14_15:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1607140257 Archived-At: Subject: Re: [stir] Comments on draft-jennings-stir-rfc4474bis-10 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Jul 2016 00:11:35 -0000 Hey Olle, Thanks for the nits, you have some good catches there, I'll implement them if I'm not commenting otherwise below. On the substantive points here: > >s/those/that/ >- =B3That signature is then placed in a SIP Identity header. =B3 > I assume both signature and JSON object? Usually not, no. As I just said in a mail to Christer, think about it like the SIP Identity header carries some information that the verification service can use to construct a JWS object, not the object itself - as the data that constitutes the bulk of that JWS object is necessarily already carried elsewhere in SIP. Hearing this for the second time, perhaps we should take the hint that this requires some motivational text. > >Section 5.1 step 5 > - =B3Finally, the authentication service MUST forward the message > normally.=B2 >What is normal? We've been using that phrase for many years - basically, it means forwarding in accordance with the Request-URI, through whatever your normal routing procedure is (RFC3263, your Route set, outbounding, whatevs).=20 > >Section 5.2: > - =B3If the verifier does not support > an Identity header present in a request due to the presence of an > unsupported "ppt" parameter, or if no Identity header is present, and > the presence of an Identity header is required by local policy (for > example, based on a per-sending-domain policy, or a per-sending-user > policy), then a 428 'Use Identity Header' response MUST be sent in > the backwards direction. =B3 > >It seems that the reason text used here doesn=B9t match the problem. >If there is an identity header with an unsupported parameter - should >this message not be conveyed back either in the response code or >in an additional header, like a warning code saying =B3unsupported ppt >param=B2. Yeah, you clipped the part there where it refers you to 13.3, and 13.3 does say you use a different reason phrase for this case ('Unsupported PASSporT Format"). I'd rather not have to write that in two places, and that sentence is already pretty long... > >Step 4: > - Does not describe actions to take if the date is outside of the >accepted range. It's true, we never defined a "stale Date" response code for this. We could. I'll bring this up at the WG. > >Section 7.3 >- =B3domain signature=B2 is not explained >- I don=B9t really like the last paragraph. In RFC 5922 SIP Domain >Certificates wildcard certificates are banned, which is not the case in >RFC 2818. 5922 seems to me a better reference, especially if we want to >be able to use the same certificate and keys. RFC 6125 section 6.4. is >also a bit more up to date on verification of domain names in certs. I'd be okay with that reference change. >Section 7.4 >- s/ayntax/syntax/ >- I would add a notice that the username part is case-sensitive and >should not be normalised, which is not the case with domains in the SIP >uri.=20 This is brand new text, so I'm glad to have some eyes on it. But is that actually what we should do? I know RFC3261 19.1.4 says that the user part is case sensitive. I fear that entities handling these messages in transit don't agree. >A not about internationalised domain names would also be good for >implementers since you mention international environments. I would think the ref to IRI is sufficient, as that in turn references IDN. >Section 12.4: >- In a scenario with Outbound Edge proxies - would the requirement of a >direct TLS connection in 12.4 require that the authentication service is >placed on the edge proxies? I would say it is natural to place it in the >registrar/auth service beyond the edge proxies, but then this requirement >fails. Direct TLS is a SHOULD in 12.4, right? I get that there are environments where that recommendation will not be upheld. 12.4 even says that in some environments it will not be viable. >Section 12.5 >- The first paragraph claims it is RECOMMENDED to employ strong >authentication practises. Section 5 claims it is a MUST. Moreover, "strong authentication practices" is not sufficiently specific; we say something actually implementable. Any ideas? >Some general comments >- I think the document would benefit from a few definitions of terms used >in the beginning, as it suffers from a chicken and egg problem. A lot of >terms is used before they are explained. I could see adding a terminology section. I'll talk about that at the WG. >- It is unclear how identity headers should be handled by a b2bua, >especially when media keying is included in the signature=8A That may be >for discussion somewhere else, but is something I expect will come up. >b2bua=B9s may be able to forward Identity headers but typically wants to >anchor media streams. It is has been discussed that discussion is not >documented in the document. This document was designed to be as conciliatory as possible to the needs of B2BUAs. But following PERPASS, we took a consensus call on this subject in the working group, and if B2BUAs do not allow media keying, we want this mechanism to fail (when media keys are in an offer). This spills over a bit to SIPBRANDY as well, where that property is quite crucial. >- Can we do this without referring to the SIPS: uri scheme? I am not >happy seeing this uri scheme turn up in new documents. That's a separate thread we'll need to pick up elsewhere. Thanks, this is helpful, just the kind of review we need now. Jon Peterson Neustar, Inc. > >/Olle > > > >_______________________________________________ >stir mailing list >stir@ietf.org >https://www.ietf.org/mailman/listinfo/stir From nobody Fri Jul 15 01:18:42 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5C98F12D967 for ; Fri, 15 Jul 2016 01:18:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lA2QZEFTZ5AP for ; Fri, 15 Jul 2016 01:18:38 -0700 (PDT) Received: from smtp7.webway.se (smtp7.webway.se [212.3.14.205]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 749E212D954 for ; Fri, 15 Jul 2016 01:18:37 -0700 (PDT) Received: from [192.168.40.18] (h87-96-134-129.cust.se.alltele.net [87.96.134.129]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp7.webway.se (Postfix) with ESMTPSA id 8E908428B; Fri, 15 Jul 2016 10:18:33 +0200 (CEST) Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: "Olle E. Johansson" In-Reply-To: <9815AE1D-6FFB-487A-B40D-BB2FE83E22B3@vigilsec.com> Date: Fri, 15 Jul 2016 10:18:35 +0200 Content-Transfer-Encoding: quoted-printable Message-Id: References: <9815AE1D-6FFB-487A-B40D-BB2FE83E22B3@vigilsec.com> To: Russ Housley X-Mailer: Apple Mail (2.3124) Archived-At: Cc: IETF STIR Mail List , Olle E Johansson Subject: Re: [stir] Comments on draft-jennings-stir-rfc4474bis-10 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Jul 2016 08:18:41 -0000 > On 15 Jul 2016, at 01:35, Russ Housley wrote: >=20 > Did you mean draft-ietf-stir-rfc4474bis-10? That=92s a good question, I had many tabs open. Will check. Sorry. /O >=20 >=20 > On Jul 14, 2016, at 7:49 AM, Olle E. Johansson wrote: >=20 >> Hi! >> I=92ve been reading this draft and have a few nits and some general = comments below. >>=20 >> Section 3 >> - Maybe add subparagraphs for SIP URI=92s and telephone numbers. It=92s= a very long section. >> -=20 >> =93The authentication service then computes a signature over >> those JSON object in a manner following PASSporT.=94 >>=20 >> s/those/that/ >> - =93That signature is then placed in a SIP Identity header. =93 >> I assume both signature and JSON object? >>=20 >> - =93In these cases, implementation the authentication service at an >> intermediary may be more practical.=94 >> s/implementation/implementing/ >>=20 >> Section 5.1 >> - =93The procedures below define the steps that must be taken when = each an >> header is added.=94 >> s/an // >>=20 >> Section 5.1 step 4 >> - =93Subsequently, the authentication service MUST form a = PASSporT object >> and add a corresponding an Identity header to the request containing >> this signature.=94 >> s/an Identity/Identity/ >>=20 >> Section 5.1 step 5 >> - =93Finally, the authentication service MUST forward the = message >> normally.=94 >> What is normal? >>=20 >> Section 5.2: >> - =93If the verifier does not support >> an Identity header present in a request due to the presence of an >> unsupported "ppt" parameter, or if no Identity header is present, = and >> the presence of an Identity header is required by local policy (for >> example, based on a per-sending-domain policy, or a per-sending-user >> policy), then a 428 'Use Identity Header' response MUST be sent in >> the backwards direction. =93 >>=20 >> It seems that the reason text used here doesn=92t match the problem. >> If there is an identity header with an unsupported parameter - should >> this message not be conveyed back either in the response code or >> in an additional header, like a warning code saying =93unsupported = ppt param=94. >>=20 >> Section 5.2 Step 1: >> - =93The verifier MUST inspect any optional "ppt" parameter = appearing the >> Identity request.=94 >> s/appearing/appearing in / >>=20 >> Step 4: >> - Does not describe actions to take if the date is outside of the = accepted range. >>=20 >> Step 4: >> - =93The handling of the message after the >> verification process depends on how the implementation service is >> implemented and on local policy.=94 >> Do you really mean =93implementation service=94? Maybe =93verification = service=94 ? >>=20 >> Section 5.2.1: >> - =93If the optional "canon" parameter of the Identity header is = present, >> it contains a base64 encoding of the header and claim component of >> the PASSporT object constructed by the authentication service, and >> this it conveys any canonical telephone number formats created by = the >> authentication service (see Section 7.2), as well as an "iat" claim >> corresponding to the Date header that the authentication service >> used.=94 >> The phrase =93this it=94 seems wrong to me, maybe you mean =93thus = it=94 >>=20 >> Section 6.2: >> - =93Provided that the credential used to sign a >> message is not previously known to the verifier, SIP entities SHOULD >> discover this credential by dereferencing the "info" parameter, >> unless they have some more other implementation-specific way of >> acquiring the needed keying material, such as an offline store of >> periodically-updated credentials.=94 >> =93some more other=94 seems like you have one word too many.=20 >>=20 >> Section 6.3 >> - =93For example, >> imagine a case where a domain implements the authentication service >> role for a range of telephone and a user agent belonging to Alice = has >> acquired a credential for a single telephone number within that >> range. =93 >> Range of telephone WHAT? Numbers? >>=20 >> Section 7: >> - =93Ultimately, in any case where local policy canonicalizes the = idenity=94 .. >> - s/idenity/identity/ >>=20 >> Section 7.3 >> - =93domain signature=94 is not explained >> - I don=92t really like the last paragraph. In RFC 5922 SIP Domain = Certificates wildcard certificates are banned, which is not the case in = RFC 2818. 5922 seems to me a better reference, especially if we want to = be able to use the same certificate and keys. RFC 6125 section 6.4. is = also a bit more up to date on verification of domain names in certs. >> Section 7.4 >> - s/ayntax/syntax/ >> - I would add a notice that the username part is case-sensitive and = should not be normalised, which is not the case with domains in the SIP = uri. A not about internationalised domain names would also be good for = implementers since you mention international environments. >> Section 11: >> - =93Similar practices could be used to support opportunistic >> signing of SIP requests for UA-integrated authentications services >> with self-signed certificates, though that is outside the scope of >> this specification and is left as a matter for future = investigation.=94 >> s/authentications/authentication/ >> - The first reference to RFC3325 seems to lack a link in the HTML = version: =93[RFC3325] defines the "id" priv-value token, which is = specific to the P-Asserted-Identity header.=94 >>=20 >> Section 12.4: >> - In a scenario with Outbound Edge proxies - would the requirement of = a direct TLS connection in 12.4 require that the authentication service = is placed on the edge proxies? I would say it is natural to place it in = the registrar/auth service beyond the edge proxies, but then this = requirement fails. >>=20 >> Section 12.5 >> - The first paragraph claims it is RECOMMENDED to employ strong = authentication practises. Section 5 claims it is a MUST. >>=20 >> Some general comments >> - I think the document would benefit from a few definitions of terms = used in the beginning, as it suffers from a chicken and egg problem. A = lot of terms is used before they are explained. >>=20 >> - It is unclear how identity headers should be handled by a b2bua, = especially when media keying is included in the signature=85 That may be = for discussion somewhere else, but is something I expect will come up. = b2bua=92s may be able to forward Identity headers but typically wants to = anchor media streams. It is has been discussed that discussion is not = documented in the document. >>=20 >> - Can we do this without referring to the SIPS: uri scheme? I am not = happy seeing this uri scheme turn up in new documents. >>=20 >> /Olle >>=20 >>=20 >>=20 >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir >=20 From nobody Fri Jul 15 02:09:19 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D3A2B12DC0D for ; Fri, 15 Jul 2016 02:09:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.22 X-Spam-Level: X-Spam-Status: No, score=-4.22 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GeB7DYRoc9ii for ; Fri, 15 Jul 2016 02:09:15 -0700 (PDT) Received: from sesbmg22.ericsson.net (sesbmg22.ericsson.net [193.180.251.48]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8CFE112DC28 for ; Fri, 15 Jul 2016 02:09:08 -0700 (PDT) X-AuditID: c1b4fb30-f79486d0000069d0-46-5788a833bdff Received: from ESESSHC010.ericsson.se (Unknown_Domain [153.88.183.48]) by sesbmg22.ericsson.net (Symantec Mail Security) with SMTP id A0.23.27088.338A8875; Fri, 15 Jul 2016 11:09:07 +0200 (CEST) Received: from ESESSMB208.ericsson.se ([169.254.8.19]) by ESESSHC010.ericsson.se ([153.88.183.48]) with mapi id 14.03.0294.000; Fri, 15 Jul 2016 11:09:01 +0200 From: Christer Holmberg To: "Peterson, Jon" , IETF STIR Mail List Thread-Topic: [stir] Separation of JWS Thread-Index: AQHR3imlxQWCiaKHYkOkgu/OqfssD6AZMS/w Date: Fri, 15 Jul 2016 09:09:00 +0000 Message-ID: <7594FB04B1934943A5C02806D1A2204B476AB520@ESESSMB208.ericsson.se> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [153.88.183.149] Content-Type: multipart/alternative; boundary="_000_7594FB04B1934943A5C02806D1A2204B476AB520ESESSMB208erics_" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprEIsWRmVeSWpSXmKPExsUyM2K7ga7xio5wg1M9UhZnGiwtlq/dxuTA 5LFkyU8mjx0Nz5kDmKK4bFJSczLLUov07RK4MqY+XctWsD2g4ubTrUwNjFNduxg5OSQETCS+ zt/ABGGLSVy4t56ti5GLQ0jgCKPE3iPL2UESQgKLGSX6r8p2MXJwsAlYSHT/0wYJiwiESkzq mM4IYgsLqEo8vv6VDSKuJjG/9yIrhG0k8ffaDrD5LEA1Z5/PZAaxeQV8JSZdnssCMd5M4knz R7A4p4C5xIKONrC1jED3fD+1BqyXWUBc4taT+VB3Ckgs2XOeGcIWlXj5+B8rhK0ksfbwdhaI +nyJN+shzucVEJQ4OfMJywRGkVlIRs1CUjYLSRlEXEdiwe5PbBC2tsSyha+ZYewzBx4zIYsv YGRfxShanFqclJtuZKSXWpSZXFycn6eXl1qyiREYUwe3/DbYwfjyueMhRgEORiUeXoXL7eFC rIllxZW5hxglOJiVRHhTlneEC/GmJFZWpRblxxeV5qQWH2KU5mBREuf1f6kYLiSQnliSmp2a WpBaBJNl4uCUamDU/Gv8/+VSd07LG/HZBw7nsf190JoUc+pgs9yNxItCL9ctUUxqnXn/+dsp h/unPJj3KUl4duEUiaIH3R/cH2TWvC9aO83d9sPsI3d3um6at0s0Y/Jy4w9/bm6cbqZ9vE7t /LTEiOBDz25+4t9vs0Xofc2p1enq2+04LuetmZPI9/GDTG1FRknsDCWW4oxEQy3mouJEAIG9 mEKlAgAA Archived-At: Subject: Re: [stir] Separation of JWS X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Jul 2016 09:09:17 -0000 --_000_7594FB04B1934943A5C02806D1A2204B476AB520ESESSMB208erics_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi, > This is partly the same question as we are exploring in the "syntax chang= e" thread discussion on whether or not "canon" will always be included. It's not really the same. My question is: *IF* the claims are included, why= do we put them in a separate place (the "canon" header field parameter)? W= hy don't we use the standard JWS mechanism? >To answer your question, think about it as if SIP does not carry a JWS obj= ect, but instead it transports some data that allows a verification service >to generate a JWS object. So we're not "sending" the JWS object, and thus = we're under no obligation to "send it as one string" or whatever. > >The rfc4474bis "canon" parameter optionally contains the encoded portion o= f the header and claims of the JWS object because the headers (and claims) = in baseline PASSporT are usually redundant wth the contents of >a SIP reque= st - we anticipate that any verification service can ordinarily regenerate = those headers and claims itself, so, there's no ostensible value in carryin= g them. Generally speaking, we should bloating messages >with redundant fie= lds if we can. I agree. But, Appendix F describes how to do that with JWS. >If you're asking why we chose to demarcate that with "canon" rather than j= ust not including the JWS header and claims if we didn't >want to include the JWS header and claims, it is generally better to be ex= plicit than to leave the verification service to infer what is going. In my opinion it's better to follow the standard. And, again, Appendix F de= scribes how to not included the claims in a standard way. Also, I am not sure (need to verify) whether it's allowed to remove all hea= ders. Also, *IF* we want to use the "canon" header field parameter, the draft doe= sn't give enough information on how it is generated. We have the following syntax in Section 8: canonical-str =3D "canon" EQUAL *base64-char ...and, in a few places of the document we have text like: "The syntax of "canon" is given in Section 8; essentially, it contains a ba= se64 encoding of the JSON header and claims in the PASSporT object= ." But, I cannot find text on how that base64-char string is generated. You ha= ve the base64 encoding of the JSON header, and the base64 encoding of the c= laims. How do you combine them into the base64 encoded "canon" value? Regards, Christer --_000_7594FB04B1934943A5C02806D1A2204B476AB520ESESSMB208erics_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi,<= /p>

 

> This is partly the same question as we are exploring in the &= quot;syntax change" thread discussion on whether or not "canon&qu= ot; will always be included.

 

It’s not really the same. My question is: *= IF* the claims are included, why do we put them in a separate place (th= e “canon” header field parameter)? Why don’t we use the s= tandard JWS mechanism?

&n= bsp;

>To answer your question, think about it as if SIP does not car= ry a JWS object, but instead it transports some data that allows a verifica= tion service

>to = generate a JWS object. So we're not "sending" the JWS object, and= thus we're under no obligation to "send it as one string" or wha= tever.

> 

>The rfc4474bis "canon" parameter optionally contains= the encoded portion of the header and claims of the JWS object because the= headers (and claims) in baseline PASSporT are usually redundant wth the contents of >a SIP= request - we anticipate that any verification service can ordinarily regen= erate those headers and claims itself, so, there's no ostensible value in c= arrying them. Generally speaking, we should bloating messages >with redun= dant fields if we can. 

 

I agree. But, Appendix F describes how to do that wi= th JWS.

 

>If you're asking why we chose to demarcate that with "can= on" rather than just not including the JWS header and claims if we did= n't

>wan= t to include the JWS header and claims, it is generally better to be explic= it than to leave the verification service to infer what is going.

 

In my opinion it’s better to follow the standa= rd. And, again, Appendix F describes how to not included the claims in a st= andard way.

 

Also, I am not sure (need to verify) whether it̵= 7;s allowed to remove all headers.

 

Also, *IF* we want to use the “canon= 221; header field parameter, the draft doesn’t give enough informatio= n on how it is generated.

 

We have the following syntax in Section 8:

 

canonical-str =3D "= ;canon" EQUAL *base64-char

 

…and, in a few places of the document we have = text like:

 

“The syntax of &q= uot;canon" is given in Section 8; essentially, it contains a base64

         &nb= sp;    encoding of the JSON header and claims in the PASSpor= T object.”

 

But, I cannot find text on how that base64-char stri= ng is generated. You have the base64 encoding of the JSON header, and the b= ase64 encoding of the claims. How do you combine them into the base64 encod= ed “canon” value?

 

Regards,

 

Christer

 

--_000_7594FB04B1934943A5C02806D1A2204B476AB520ESESSMB208erics_-- From nobody Fri Jul 15 06:14:46 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 51F7512D753 for ; Fri, 15 Jul 2016 06:14:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.6 X-Spam-Level: X-Spam-Status: No, score=-102.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BL-MBakfWBKM for ; Fri, 15 Jul 2016 06:14:44 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0b-0018ba01.pphosted.com [67.231.157.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 225F412D78D for ; Fri, 15 Jul 2016 06:07:23 -0700 (PDT) Received: from pps.filterd (m0078668.ppops.net [127.0.0.1]) by mx0b-0018ba01.pphosted.com (8.16.0.17/8.16.0.17) with SMTP id u6FD3SGP016615; Fri, 15 Jul 2016 09:07:20 -0400 Received: from stntexhc10.cis.neustar.com ([156.154.17.216]) by mx0b-0018ba01.pphosted.com with ESMTP id 246y44ga8y-1 (version=TLSv1 cipher=AES128-SHA bits=128 verify=NOT); Fri, 15 Jul 2016 09:07:20 -0400 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.94]) by stntexhc10.cis.neustar.com ([169.254.4.225]) with mapi id 14.03.0279.002; Fri, 15 Jul 2016 09:07:19 -0400 From: "Peterson, Jon" To: Christer Holmberg Thread-Topic: [stir] Separation of JWS Thread-Index: AQHR3imlxQWCiaKHYkOkgu/OqfssD6AZMS/wgABGHqE= Date: Fri, 15 Jul 2016 13:07:18 +0000 Message-ID: <7B90D2FC-7142-4801-B84E-FB459A2339C9@neustar.biz> References: , <7594FB04B1934943A5C02806D1A2204B476AB520@ESESSMB208.ericsson.se> In-Reply-To: <7594FB04B1934943A5C02806D1A2204B476AB520@ESESSMB208.ericsson.se> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: multipart/alternative; boundary="_000_7B90D2FC71424801B84EFB459A2339C9neustarbiz_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-07-15_06:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1607150140 Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] Separation of JWS X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Jul 2016 13:14:45 -0000 --_000_7B90D2FC71424801B84EFB459A2339C9neustarbiz_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Oh, you meant Appendix F of RFC7515. I had thought you said RFC7315 in your= other mail, so perhaps you can understand my confusion. My reading of that is that it can remove the claims but not the header. But= it's also not super specific about how it works. 5.2.1 of rfc4474bis-10 contains the crispest statement of the syntax of can= on, perhaps, but it is not the job of rfc4474bis to repeat the guidance of = PASSporT on how to construct the object. Perhaps a pointer to that specific= section of PASSporT would help? Jon Peterson Neustar, Inc. Sent from my iPad On Jul 15, 2016, at 2:09 AM, Christer Holmberg > wrote: Hi, > This is partly the same question as we are exploring in the "syntax chang= e" thread discussion on whether or not "canon" will always be included. It=92s not really the same. My question is: *IF* the claims are included, w= hy do we put them in a separate place (the =93canon=94 header field paramet= er)? Why don=92t we use the standard JWS mechanism? >To answer your question, think about it as if SIP does not carry a JWS obj= ect, but instead it transports some data that allows a verification service >to generate a JWS object. So we're not "sending" the JWS object, and thus = we're under no obligation to "send it as one string" or whatever. > >The rfc4474bis "canon" parameter optionally contains the encoded portion o= f the header and claims of the JWS object because the headers (and claims) = in baseline PASSporT are usually redundant wth the contents of >a SIP reque= st - we anticipate that any verification service can ordinarily regenerate = those headers and claims itself, so, there's no ostensible value in carryin= g them. Generally speaking, we should bloating messages >with redundant fie= lds if we can. I agree. But, Appendix F describes how to do that with JWS. >If you're asking why we chose to demarcate that with "canon" rather than j= ust not including the JWS header and claims if we didn't >want to include the JWS header and claims, it is generally better to be ex= plicit than to leave the verification service to infer what is going. In my opinion it=92s better to follow the standard. And, again, Appendix F = describes how to not included the claims in a standard way. Also, I am not sure (need to verify) whether it=92s allowed to remove all h= eaders. Also, *IF* we want to use the =93canon=94 header field parameter, the draft= doesn=92t give enough information on how it is generated. We have the following syntax in Section 8: canonical-str =3D "canon" EQUAL *base64-char =85and, in a few places of the document we have text like: =93The syntax of "canon" is given in Section 8; essentially, it contains a = base64 encoding of the JSON header and claims in the PASSporT object= .=94 But, I cannot find text on how that base64-char string is generated. You ha= ve the base64 encoding of the JSON header, and the base64 encoding of the c= laims. How do you combine them into the base64 encoded =93canon=94 value? Regards, Christer --_000_7B90D2FC71424801B84EFB459A2339C9neustarbiz_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable
Oh, you meant Appendix F of RFC7515. I had thought you said RFC7315 in= your other mail, so perhaps you can understand my confusion.  

My reading of that is that it can remove the claims but not the header= . But it's also not super specific about how it works. 

5.2.1 of rfc4474bis-10 contains the crispest statement of the syntax o= f canon, perhaps, but it is not the job of rfc4474bis to repeat the guidanc= e of PASSporT on how to construct the object. Perhaps a pointer to that spe= cific section of PASSporT would help?

Jon Peterson
Neustar, Inc.

Sent from my iPad

On Jul 15, 2016, at 2:09 AM, Christer Holmberg <christer.holmberg@ericsson.com> wrote:

Hi,<= /p>

 

> This is partly the same question as we are exploring in the &= quot;syntax change" thread discussion on whether or not "canon&qu= ot; will always be included.

 

It=92s not really the same. My question is: *IF* the claims are included, why do we put them in a separate place (the = =93canon=94 header field parameter)? Why don=92t we use the standard JWS me= chanism?

&n= bsp;

>To answer your question, think about it as if SIP does not car= ry a JWS object, but instead it transports some data that allows a verifica= tion service

>to = generate a JWS object. So we're not "sending" the JWS object, and= thus we're under no obligation to "send it as one string" or wha= tever.

> 

>The rfc4474bis "canon" parameter optionally contains= the encoded portion of the header and claims of the JWS object because the= headers (and claims) in baseline PASSporT are usually redundant wth the contents of >a SIP= request - we anticipate that any verification service can ordinarily regen= erate those headers and claims itself, so, there's no ostensible value in c= arrying them. Generally speaking, we should bloating messages >with redun= dant fields if we can. 

 

I agree. But, Appendix F describes how to do that wi= th JWS.

 

>If you're asking why we chose to demarcate that with "can= on" rather than just not including the JWS header and claims if we did= n't

>wan= t to include the JWS header and claims, it is generally better to be explic= it than to leave the verification service to infer what is going.

 

In my opinion it=92s better to follow the standard. = And, again, Appendix F describes how to not included the claims in a standa= rd way.

 

Also, I am not sure (need to verify) whether it=92s = allowed to remove all headers.

 

Also, *IF* we want to use the =93canon=94 hea= der field parameter, the draft doesn=92t give enough information on how it = is generated.

 

We have the following syntax in Section 8:

 

canonical-str =3D "= ;canon" EQUAL *base64-char

 

=85and, in a few places of the document we have text= like:

 

=93The syntax of "= canon" is given in Section 8; essentially, it contains a base64

         &nb= sp;    encoding of the JSON header and claims in the PASSpor= T object.=94

 

But, I cannot find text on how that base64-char stri= ng is generated. You have the base64 encoding of the JSON header, and the b= ase64 encoding of the claims. How do you combine them into the base64 encod= ed =93canon=94 value?

 

Regards,

 

Christer

 

--_000_7B90D2FC71424801B84EFB459A2339C9neustarbiz_-- From nobody Fri Jul 15 08:35:57 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8E83112D119 for ; Fri, 15 Jul 2016 08:35:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.22 X-Spam-Level: X-Spam-Status: No, score=-4.22 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EU27wemN7KDa for ; Fri, 15 Jul 2016 08:35:54 -0700 (PDT) Received: from sesbmg23.ericsson.net (sesbmg23.ericsson.net [193.180.251.37]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 54F0A12D09F for ; Fri, 15 Jul 2016 08:35:53 -0700 (PDT) X-AuditID: c1b4fb25-f79f26d00000327e-d7-578902d729ad Received: from ESESSHC005.ericsson.se (Unknown_Domain [153.88.183.33]) by sesbmg23.ericsson.net (Symantec Mail Security) with SMTP id 3D.49.12926.7D209875; Fri, 15 Jul 2016 17:35:51 +0200 (CEST) Received: from ESESSMB208.ericsson.se ([169.254.8.19]) by ESESSHC005.ericsson.se ([153.88.183.33]) with mapi id 14.03.0294.000; Fri, 15 Jul 2016 17:35:50 +0200 From: Christer Holmberg To: "Peterson, Jon" Thread-Topic: [stir] Separation of JWS Thread-Index: AQHR3imlxQWCiaKHYkOkgu/OqfssD6AZMS/wgABGHqGAACXa4A== Date: Fri, 15 Jul 2016 15:35:50 +0000 Message-ID: <7594FB04B1934943A5C02806D1A2204B476ABFD3@ESESSMB208.ericsson.se> References: , <7594FB04B1934943A5C02806D1A2204B476AB520@ESESSMB208.ericsson.se> <7B90D2FC-7142-4801-B84E-FB459A2339C9@neustar.biz> In-Reply-To: <7B90D2FC-7142-4801-B84E-FB459A2339C9@neustar.biz> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [153.88.183.154] Content-Type: multipart/alternative; boundary="_000_7594FB04B1934943A5C02806D1A2204B476ABFD3ESESSMB208erics_" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprHIsWRmVeSWpSXmKPExsUyM2K7ou51ps5wg54WHYszDZYWy9duY3Jg 8liy5CeTx46G58wBTFFcNimpOZllqUX6dglcGesvfmYu6KmsOHRuM3sD48X0LkZODgkBE4lZ O7+yQdhiEhfurQeyuTiEBI4wSuz4uQfKWcwocfbYd5YuRg4ONgELie5/2iANIgJ6Et++z2AC sZkF1CVePHrDDmILC6hKPL4OMVREQE1ifu9FVgjbSWJhTzcjiM0CVNP+bDNYPa+Ar8SlV/eY IHatZZR4MOMIWAOngL3E8p/PwGxGoOu+n1oDtUxc4taT+UwQVwtILNlznhnCFpV4+fgfK4St JLHo9mcmkJuZBfIlFvfVQewSlDg58wnLBEbRWUgmzUKomoWkCqJER2LB7k9sELa2xLKFr5lh 7DMHHjMhiy9gZF/FKFqcWpyUm25krJdalJlcXJyfp5eXWrKJERhrB7f8Vt3BePmN4yFGAQ5G JR5ehcvt4UKsiWXFlbmHGCU4mJVEeCv+doQL8aYkVlalFuXHF5XmpBYfYpTmYFES5/V/qRgu JJCeWJKanZpakFoEk2Xi4JRqYPTl0pp669V1hUqvkKst1+4L7l/NNCmjkWd2uM5krsMflpi6 /mxZFbM5ImuyRfPSPQsfMR7/xuO6dv7zWbMv7FGf8HjisRjWe4JiXxY0XRRu2b3WY6fPj1jh NEeD8NWpqTtvvznhFnqKcafM5CrZzj0HmTL5bNv4ow4ZNPPphk3JmdG9dfkpUWUlluKMREMt 5qLiRADkmSGwsQIAAA== Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] Separation of JWS X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Jul 2016 15:35:55 -0000 --_000_7594FB04B1934943A5C02806D1A2204B476ABFD3ESESSMB208erics_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi, >Oh, you meant Appendix F of RFC7515. I had thought you said RFC7315 in you= r other mail, so perhaps you can understand my confusion. Sorry :) >My reading of that is that it can remove the claims but not the header. Bu= t it's also not super specific about how it works. What do you think is unclear? I am using it for a draft I'm working on, and I think it's pretty clear :) I am also not sure why we should remove the headers. Don't we need that inf= ormation? >5.2.1 of rfc4474bis-10 contains the crispest statement of the syntax of ca= non, perhaps, but it is not the job of rfc4474bis to repeat the guidance of >PASSporT on how to construct the object. Perhaps a pointer to that specifi= c section of PASSporT would help? My question is not how to construct the object, but how to construct the "c= anon" header field value, which seems to be only a part of the object strin= g. Section 5.2.1 describes which components (headers and claims) are used to c= reate the "canon" value, but now HOW it's created. So, I'd like to suggest that we transport the PASSportT object string as th= e Identity header field value, and don't use "canon". I am happy to hear wh= y we can't do that, but so far I have not heard/read anything :) That would also allow people to use off-the-shelf JWS encoders/decoders, an= d we would avoid the confusion of transporting different parts of the objec= t string in different places. Regards, Christer On Jul 15, 2016, at 2:09 AM, Christer Holmberg > wrote: Hi, > This is partly the same question as we are exploring in the "syntax chang= e" thread discussion on whether or not "canon" will always be included. It's not really the same. My question is: *IF* the claims are included, why= do we put them in a separate place (the "canon" header field parameter)? W= hy don't we use the standard JWS mechanism? >To answer your question, think about it as if SIP does not carry a JWS obj= ect, but instead it transports some data that allows a verification service >to generate a JWS object. So we're not "sending" the JWS object, and thus = we're under no obligation to "send it as one string" or whatever. > >The rfc4474bis "canon" parameter optionally contains the encoded portion o= f the header and claims of the JWS object because the headers (and claims) = in baseline PASSporT are usually redundant wth the contents of >a SIP reque= st - we anticipate that any verification service can ordinarily regenerate = those headers and claims itself, so, there's no ostensible value in carryin= g them. Generally speaking, we should bloating messages >with redundant fie= lds if we can. I agree. But, Appendix F describes how to do that with JWS. >If you're asking why we chose to demarcate that with "canon" rather than j= ust not including the JWS header and claims if we didn't >want to include the JWS header and claims, it is generally better to be ex= plicit than to leave the verification service to infer what is going. In my opinion it's better to follow the standard. And, again, Appendix F de= scribes how to not included the claims in a standard way. Also, I am not sure (need to verify) whether it's allowed to remove all hea= ders. Also, *IF* we want to use the "canon" header field parameter, the draft doe= sn't give enough information on how it is generated. We have the following syntax in Section 8: canonical-str =3D "canon" EQUAL *base64-char ...and, in a few places of the document we have text like: "The syntax of "canon" is given in Section 8; essentially, it contains a ba= se64 encoding of the JSON header and claims in the PASSporT object= ." But, I cannot find text on how that base64-char string is generated. You ha= ve the base64 encoding of the JSON header, and the base64 encoding of the c= laims. How do you combine them into the base64 encoded "canon" value? Regards, Christer --_000_7594FB04B1934943A5C02806D1A2204B476ABFD3ESESSMB208erics_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi,<= /p>

 

>Oh, you meant Appendix F of RFC7515. I had thoug= ht you said RFC7315 in your other mail, so perhaps you can understand my co= nfusion.  

&nbs= p;

Sorry :)<= o:p>

 

>My reading of that is that it can remove the cla= ims but not the header. But it's also not super specific about how it works= . 

 

What do you think is unclear?

 

I am using it for a draft I’m working on, and = I think it’s pretty clear :)

 

I am also not sure why we should remove the headers.= Don’t we need that information?

 

>5.2.1 of rfc4474bis-10 contains the crispest sta= tement of the syntax of canon, perhaps, but it is not the job of rfc4474bis= to repeat the guidance of

>PASSporT on how to construct the object. Perhaps= a pointer to that specific section of PASSporT would help?

 

My question is not how to construct the object, but = how to construct the “canon” header field value, which seems to= be only a part of the object string.

 

Section 5.2.1 describes which components (headers an= d claims) are used to create the “canon” value, but now HOW it&= #8217;s created.

 

So, I’d like to suggest that we transport the = PASSportT object string as the Identity header field value, and don’t= use “canon”. I am happy to hear why we can’t do that, bu= t so far I have not heard/read anything :)

 

That would also allow people to use off-the-shelf JW= S encoders/decoders, and we would avoid the confusion of transporting diffe= rent parts of the object string in different places.

 

Regards,

 

Christer

 


On Jul 15, 2016, at 2:09 AM, Christer Holmberg <christer.holmberg@ericsson.com> wrote:

Hi,<= /p>

 

> This is partly the same question as we are exploring in the &= quot;syntax change" thread discussion on whether or not "canon&qu= ot; will always be included.

 

It’s not really the same. My question is: *= IF* the claims are included, why do we put them in a separate place (th= e “canon” header field parameter)? Why don’t we use the s= tandard JWS mechanism?

 <= /span>

>To answer your question, think about it as if SIP does not car= ry a JWS object, but instead it transports some data that allows a verifica= tion service

>to = generate a JWS object. So we're not "sending" the JWS object, and= thus we're under no obligation to "send it as one string" or wha= tever.

> 

>The rfc4474bis "canon" parameter optionally contains= the encoded portion of the header and claims of the JWS object because the= headers (and claims) in baseline PASSporT are usually redundant wth the contents of >a SIP= request - we anticipate that any verification service can ordinarily regen= erate those headers and claims itself, so, there's no ostensible value in c= arrying them. Generally speaking, we should bloating messages >with redun= dant fields if we can. 

 <= /o:p>

I agree. But, Appendix F describes how to do that wi= th JWS.

 

>If you're asking why we chose to demarcate that with "can= on" rather than just not including the JWS header and claims if we did= n't

>wan= t to include the JWS header and claims, it is generally better to be explic= it than to leave the verification service to infer what is going.

 <= /o:p>

In my opinion it’s better to follow the standa= rd. And, again, Appendix F describes how to not included the claims in a st= andard way.

 

Also, I am not sure (need to verify) whether it̵= 7;s allowed to remove all headers.

 

Also, *IF* we want to use the “canon= 221; header field parameter, the draft doesn’t give enough informatio= n on how it is generated.

 

We have the following syntax in Section 8:

 

canonical-str =3D "= ;canon" EQUAL *base64-char

 

…and, in a few places of the document we have = text like:

 

“The syntax of &q= uot;canon" is given in Section 8; essentially, it contains a base64

         &nb= sp;    encoding of the JSON header and claims in the PASSpor= T object.”

 

But, I cannot find text on how that base64-char stri= ng is generated. You have the base64 encoding of the JSON header, and the b= ase64 encoding of the claims. How do you combine them into the base64 encod= ed “canon” value?

 

Regards,

 

Christer

 

--_000_7594FB04B1934943A5C02806D1A2204B476ABFD3ESESSMB208erics_-- From nobody Sat Jul 16 03:29:16 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B3B3612D886 for ; Sat, 16 Jul 2016 03:29:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (768-bit key) header.d=shockey.us Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gdbgzADpf7vt for ; Sat, 16 Jul 2016 03:29:09 -0700 (PDT) Received: from gproxy10-pub.mail.unifiedlayer.com (gproxy10-pub.mail.unifiedlayer.com [69.89.20.226]) by ietfa.amsl.com (Postfix) with SMTP id 9E266126579 for ; Sat, 16 Jul 2016 03:29:09 -0700 (PDT) Received: (qmail 25699 invoked by uid 0); 16 Jul 2016 10:29:09 -0000 Received: from unknown (HELO cmgw4) (10.0.90.85) by gproxy10.mail.unifiedlayer.com with SMTP; 16 Jul 2016 10:29:09 -0000 Received: from box462.bluehost.com ([74.220.219.62]) by cmgw4 with id KNV21t00e1MNPNq01NV5k8; Sat, 16 Jul 2016 04:29:09 -0600 X-Authority-Analysis: v=2.1 cv=TIHWFTVa c=1 sm=1 tr=0 a=jTEj1adHphCQ5SwrTAOQMg==:117 a=jTEj1adHphCQ5SwrTAOQMg==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=8WrITzYgnNwA:10 a=iYKGedMQ2FkA:10 a=cAmyUtKerLwA:10 a=PeFO9FbFhS32YxYntvkA:9 a=ll-iCDY8AAAA:8 a=M0OflfRGAAAA:8 a=48vgC7mUAAAA:8 a=0FD05c-RAAAA:8 a=hGBaWAWWAAAA:8 a=huiTB0zX7NJRyqYxpzUA:9 a=EdJ4DejPfbgi2Y94:21 a=YJdyE0uYE9lotU7m:21 a=QEXdDO2ut3YA:10 a=ivbTfD_dPm4A:10 a=yMhMjlubAAAA:8 a=SSmOFEACAAAA:8 a=NXoWxPpEwyvvu9fz:21 a=605MGq-KOP4_lB4G:21 a=kSmcI4zOQ5XCKz8D:21 a=gKO2Hq4RSVkA:10 a=UiCQ7L4-1S4A:10 a=hTZeC7Yk6K0A:10 a=frz4AuCg-hUA:10 a=VpyrLIdO_Ztbr3SWPBuH:22 a=6yl0mh0s51TKORVA8GqK:22 a=w1C3t2QeGrPiZgrLijVG:22 a=l1rpMCqCXRGZwUSuRcM3:22 a=Q-ofuW86YyylptHqTH-7:22 a=BKKCjISod1eDJeS0ORpz:22 a=zjWhRoSqWz9hl55Hdlzg:22 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=shockey.us; s=default; h=Content-type:Mime-version:In-Reply-To:References:Message-ID:CC: To:From:Subject:Date; bh=jd2cPDq4dQeg6DYIcRYHxjIA25+EXbcBr+xgXdjb5Ww=; b=Vf5/ 9mePsjIABIhfqCWLkmmRmHuOXh1CMQqQk5DpByIIMFCMWzYk7oG/Ur4NLi4Ac8OHiebvdgpa8/mmn G/akseU79aZEiJaj1x9zZskJ4TLg/VKpA1KsD/ZoutX7dEx; Received: from [31.133.143.179] (port=61817) by box462.bluehost.com with esmtpa (Exim 4.86_2) (envelope-from ) id 1bOMqD-0001Sr-KX; Sat, 16 Jul 2016 04:29:02 -0600 User-Agent: Microsoft-MacOutlook/f.18.0.160709 Date: Sat, 16 Jul 2016 12:28:52 +0200 From: Richard Shockey To: Christer Holmberg , "Peterson, Jon" Message-ID: Thread-Topic: [stir] Separation of JWS References: <7594FB04B1934943A5C02806D1A2204B476AB520@ESESSMB208.ericsson.se> <7B90D2FC-7142-4801-B84E-FB459A2339C9@neustar.biz> <7594FB04B1934943A5C02806D1A2204B476ABFD3@ESESSMB208.ericsson.se> In-Reply-To: <7594FB04B1934943A5C02806D1A2204B476ABFD3@ESESSMB208.ericsson.se> Mime-version: 1.0 Content-type: multipart/alternative; boundary="B_3551516941_1761157956" X-Identified-User: {3286:box462.bluehost.com:shockeyu:shockey.us} {sentby:smtp auth 31.133.143.179 authed with richard+shockey.us} X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box462.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - shockey.us X-Source-IP: 31.133.143.179 X-Exim-ID: 1bOMqD-0001Sr-KX X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: ([31.133.143.179]) [31.133.143.179]:61817 X-Source-Auth: richard+shockey.us X-Email-Count: 0 X-Source-Cap: c2hvY2tleXU7c2hvY2tleXU7Ym94NDYyLmJsdWVob3N0LmNvbQ== Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] Separation of JWS X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 16 Jul 2016 10:29:13 -0000 > This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --B_3551516941_1761157956 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable =20 Christer if you are frustrated I certainly understand.=C2=A0=C2=A0=20 =20 As I have read through v10 here I=E2=80=99m wondering how it can be successfully = implemented by the vendor community.=C2=A0 There is clearly strong, in fact over= whelming demand to implement this but the last thing we need are the kinds o= f baked in interoperability problems we have seen in VoLTE, for instance. =C2=A0= I can assure you the NRA=E2=80=99s have been told we have a solution but we realis= tically need to give them some implementation timelines.=20 =20 The lack of actual full examples of a typical originating INVITE, is appall= ing. =C2=A0I have serious questions whether this document is ready for adoption.= =C2=A0=20 =20 Should we just accept what we have now?=C2=A0 Should the SIP Forum immediately = look into some ongoing profile work here as we start down this road? =C2=A0=C2=A0I k= now Robert would like to see some examples of implementations at SIPit but i= s there enough time given the ongoing questions the document does not answer= .=20 =20 =20 =20 =E2=80=94=20 Richard Shockey Shockey Consulting LLC Chairman of the Board SIP Forum www.shockey.us www.sipforum.org richardshockey.us Skype-Linkedin-Facebook rshockey101 PSTN +1 703-593-2683 =20 =20 From: stir on behalf of Christer Holmberg Date: Friday, July 15, 2016 at 5:35 PM To: "Peterson, Jon" Cc: IETF STIR Mail List Subject: Re: [stir] Separation of JWS =20 Hi, =20 >Oh, you meant Appendix F of RFC7515. I had thought you said RFC7315 in you= r other mail, so perhaps you can understand my confusion. =20 =20 Sorry :) =20 >My reading of that is that it can remove the claims but not the header. Bu= t it's also not super specific about how it works.=20 =20 What do you think is unclear? =20 I am using it for a draft I=E2=80=99m working on, and I think it=E2=80=99s pretty clear= :) =20 I am also not sure why we should remove the headers. Don=E2=80=99t we need that i= nformation? =20 >5.2.1 of rfc4474bis-10 contains the crispest statement of the syntax of ca= non, perhaps, but it is not the job of rfc4474bis to repeat the guidance of=20 >PASSporT on how to construct the object. Perhaps a pointer to that specifi= c section of PASSporT would help? =20 My question is not how to construct the object, but how to construct the =E2=80= =9Ccanon=E2=80=9D header field value, which seems to be only a part of the object st= ring.=20 =20 Section 5.2.1 describes which components (headers and claims) are used to c= reate the =E2=80=9Ccanon=E2=80=9D value, but now HOW it=E2=80=99s created. =20 So, I=E2=80=99d like to suggest that we transport the PASSportT object string as = the Identity header field value, and don=E2=80=99t use =E2=80=9Ccanon=E2=80=9D. I am happy to = hear why we can=E2=80=99t do that, but so far I have not heard/read anything :) =20 That would also allow people to use off-the-shelf JWS encoders/decoders, an= d we would avoid the confusion of transporting different parts of the object= string in different places. =20 Regards, =20 Christer =20 On Jul 15, 2016, at 2:09 AM, Christer Holmberg wrote: Hi, =20 > This is partly the same question as we are exploring in the "syntax chang= e" thread discussion on whether or not "canon" will always be included. =20 It=E2=80=99s not really the same. My question is: *IF* the claims are included, w= hy do we put them in a separate place (the =E2=80=9Ccanon=E2=80=9D header field paramete= r)? Why don=E2=80=99t we use the standard JWS mechanism? =20 >To answer your question, think about it as if SIP does not carry a JWS obj= ect, but instead it transports some data that allows a verification service=20 >to generate a JWS object. So we're not "sending" the JWS object, and thus = we're under no obligation to "send it as one string" or whatever. >=20 >The rfc4474bis "canon" parameter optionally contains the encoded portion o= f the header and claims of the JWS object because the headers (and claims) i= n baseline PASSporT are usually redundant wth the contents of >a SIP request= - we anticipate that any verification service can ordinarily regenerate tho= se headers and claims itself, so, there's no ostensible value in carrying th= em. Generally speaking, we should bloating messages >with redundant fields i= f we can.=20 =20 I agree. But, Appendix F describes how to do that with JWS.=20 =20 >If you're asking why we chose to demarcate that with "canon" rather than j= ust not including the JWS header and claims if we didn't=20 >want to include the JWS header and claims, it is generally better to be ex= plicit than to leave the verification service to infer what is going. =20 In my opinion it=E2=80=99s better to follow the standard. And, again, Appendix F = describes how to not included the claims in a standard way. =20 Also, I am not sure (need to verify) whether it=E2=80=99s allowed to remove all h= eaders. =20 Also, *IF* we want to use the =E2=80=9Ccanon=E2=80=9D header field parameter, the draft= doesn=E2=80=99t give enough information on how it is generated. =20 We have the following syntax in Section 8: =20 canonical-str =3D "canon" EQUAL *base64-char =20 =E2=80=A6and, in a few places of the document we have text like: =20 =E2=80=9CThe syntax of "canon" is given in Section 8; essentially, it contains a = base64 encoding of the JSON header and claims in the PASSporT object= .=E2=80=9D =20 But, I cannot find text on how that base64-char string is generated. You ha= ve the base64 encoding of the JSON header, and the base64 encoding of the cl= aims. How do you combine them into the base64 encoded =E2=80=9Ccanon=E2=80=9D value? =20 Regards, =20 Christer =20 _______________________________________________ stir mailing list stir@ietf= .org https://www.ietf.org/mailman/listinfo/stir=20 --B_3551516941_1761157956 Content-type: text/html; charset="UTF-8" Content-transfer-encoding: quoted-printable

 

Christer if you are frustrated I certainly understand.=C2=A0=C2=A0 =

 

As I ha= ve read through v10 here I’m wondering how it can be successfully impl= emented by the vendor community.=C2=A0 There is clearly strong, in fact overwhel= ming demand to implement this but the last thing we need are the kinds of ba= ked in interoperability problems we have seen in VoLTE, for instance. =C2=A0I ca= n assure you the NRA’s have been told we have a solution but we realis= tically need to give them some implementation timelines.

 

The lack of actual fu= ll examples of a typical originating INVITE, is appalling. =C2=A0I have serious = questions whether this document is ready for adoption.=C2=A0

 

Should we just accept= what we have now?=C2=A0 Should the SIP Forum immediately look into some ongoing= profile work here as we start down this road? =C2=A0=C2=A0I know Robert would like = to see some examples of implementations at SIPit but is there enough time gi= ven the ongoing questions the document does not answer.

 

 

<= p class=3DMsoNormal> 

— 

=

Richard S= hockey

Shockey Consulting LLC

<= div>

Chairman o= f the Board SIP Forum

www.shockey.us

=

www= .sipforum.org

richard<at>shockey.us

Skype-Linkedin-Facebook rshockey101

PSTN +1 703-593-2683=

 

 

From: stir <stir-bou= nces@ietf.org> on behalf of Christer Holmberg <christer.holmberg@erics= son.com>
Date: Friday, July 15, 2016 at 5:35 PM
To: &= quot;Peterson, Jon" <jon.peterson@neustar.biz>
Cc: IETF= STIR Mail List <stir@ietf.org>
Subject: Re: [stir] Separati= on of JWS

christer.h= olmberg@ericsson.com> wrote:

Hi,=

 

> This is partly the same question as we a= re exploring in the "syntax change" thread discussion on whether o= r not "canon" will always be included.

 

It’s not really the s= ame. My question is: *IF* the claims are included, why do we put them= in a separate place (the “canon” header field parameter)? Why d= on’t we use the standard JWS mechanism?

&= nbsp;

>To answer your question, think about it as if SIP does not carry a JWS obje= ct, but instead it transports some data that allows a verification service <= /span>

>to generate a JWS object. So we're not "sending" the JWS object, = and thus we're under no obligation to "send it as one string" or w= hatever.

> 

>The rfc4474bis "canon" parameter optionally contains = the encoded portion of the header and claims of the JWS object because the h= eaders (and claims) in baseline PASSporT are usually redundant wth the conte= nts of >a SIP request - we anticipate th= at any verification service can ordinarily regenerate those headers and clai= ms itself, so, there's no ostensible value in carrying them. Generally speak= ing, we should bloating messages >with r= edundant fields if we can. 

 

= I agree. But, Appendix F describes how to do that with JWS.=

 =

>If you're asking why we chose to demarc= ate that with "canon" rather than just not including the JWS heade= r and claims if we didn't <= /p>

>want to include the JWS header and claims, it is= generally better to be explicit than to leave the verification service to i= nfer what is going.

=

 

In = my opinion it’s better to follow the standard. And, again, Appendix F = describes how to not included the claims in a standard way.

 

Also, I am not sure (need to verify) whether it= ’s allowed to remove all headers.

 

Also, *IF* we want to use the “canon” header fie= ld parameter, the draft doesn’t give enough information on how it is g= enerated.

 

We have the following= syntax in Section 8:

 

<= span lang=3DEN-GB>canonical-str =3D "canon" EQUAL *base64-char

 

…and, in a few places of the doc= ument we have text like:

 

“The syntax of "canon" is given in Sectio= n 8; essentially, it contains a base64

          &= nbsp;   encoding of the JSON header and claims in the PASSporT obj= ect.”

 <= o:p>

But, I cannot find = text on how that base64-char string is generated. You have the base64 encodi= ng of the JSON header, and the base64 encoding of the claims. How do you com= bine them into the base64 encoded “canon” value?

 

Regards,

 

Christer

&n= bsp;

___= ____________________________________________ stir mailing list stir@ietf.org= https://www.ietf.org/mailman/listinfo/stir

--B_3551516941_1761157956-- From nobody Sat Jul 16 13:00:25 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D6A0812D179 for ; Sat, 16 Jul 2016 13:00:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.22 X-Spam-Level: X-Spam-Status: No, score=-4.22 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1_07mN3A6Xwo for ; Sat, 16 Jul 2016 13:00:21 -0700 (PDT) Received: from sessmg22.ericsson.net (sessmg22.ericsson.net [193.180.251.58]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3E9B012D0EF for ; Sat, 16 Jul 2016 13:00:20 -0700 (PDT) X-AuditID: c1b4fb3a-f79386d00000467b-ed-578a92521195 Received: from ESESSHC006.ericsson.se (Unknown_Domain [153.88.183.36]) by sessmg22.ericsson.net (Symantec Mail Security) with SMTP id 19.D4.18043.2529A875; Sat, 16 Jul 2016 22:00:18 +0200 (CEST) Received: from ESESSMB209.ericsson.se ([169.254.9.208]) by ESESSHC006.ericsson.se ([153.88.183.36]) with mapi id 14.03.0294.000; Sat, 16 Jul 2016 22:00:17 +0200 From: Christer Holmberg To: Richard Shockey , "Peterson, Jon" Thread-Topic: [stir] Separation of JWS Thread-Index: AQHR3imlxQWCiaKHYkOkgu/OqfssD6AZMS/wgABGHqGAACXa4IABHrAAgAC9CEA= Date: Sat, 16 Jul 2016 20:00:16 +0000 Message-ID: <7594FB04B1934943A5C02806D1A2204B476BD10C@ESESSMB209.ericsson.se> References: <7594FB04B1934943A5C02806D1A2204B476AB520@ESESSMB208.ericsson.se> <7B90D2FC-7142-4801-B84E-FB459A2339C9@neustar.biz> <7594FB04B1934943A5C02806D1A2204B476ABFD3@ESESSMB208.ericsson.se> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [153.88.183.148] Content-Type: multipart/alternative; boundary="_000_7594FB04B1934943A5C02806D1A2204B476BD10CESESSMB209erics_" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFlrBIsWRmVeSWpSXmKPExsUyM2K7im7QpK5wg+8NfBZnGiwtZvwwsFi+ dhuTA7PHkiU/mTx2NDxn9pj48QxzAHMUl01Kak5mWWqRvl0CV8aaeX/YCu70MFXsmvuIqYHx SitTFyMnh4SAiUTvzyXsELaYxIV769m6GLk4hASOMEosfvCZEcJZwiix9/Br1i5GDg42AQuJ 7n/aIA0iAmES/7q3MILYzALqEi8evQEbJCygKvH4+lc2iBo1ifm9F1khbD+JjqP/wOpZgGoa X90Fs3kFfCXe7drGArFrOZPEt++bwRo4Bewkem6cZgGxGYGu+35qDRPEMnGJW0/mQ30gILFk z3lmCFtU4uXjf6wQtpJE45InYDczC+RLnH8YDbFLUOLkzCcsExhFZyGZNAuhahaSKoiwpsT6 XfoQ1YoSU7ofskPYGhKtc+ayI4svYGRfxShanFpcnJtuZKSXWpSZXFycn6eXl1qyiREYfwe3 /LbawXjwueMhRgEORiUe3gcxneFCrIllxZW5hxglOJiVRHjPdHSFC/GmJFZWpRblxxeV5qQW H2KU5mBREuf1f6kYLiSQnliSmp2aWpBaBJNl4uCUamCcMm+B5R4u9xXbu7cnCervzmt7cFr0 uKXA71pW/mtMU05vFm9722z4l51z8+Lvcz9M/Jja2bD4kYGpzhM5frNrpz5UJX+ea1Fd/kz2 kuW0h0pVnAaPd8+eul9TXSvyYkVwhMQkG8+nt+43Vh6WTlEJORYsuN7fbM9byU2HX0VPFWjL 4JsdmLJZiaU4I9FQi7moOBEAe/4kdrsCAAA= Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] Separation of JWS X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 16 Jul 2016 20:00:24 -0000 --_000_7594FB04B1934943A5C02806D1A2204B476BD10CESESSMB209erics_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGksDQoNCkkgYW0gY29tbWVudGluZyB3aXRoIGFuIGltcGxlbWVudGVyIGhhdCBvbiwgYW5kIEkg ZG9u4oCZdCB0aGluayB3ZSBzaG91bGQgYWNjZXB0IHdoYXQgd2UgaGF2ZSBub3cuIEluIG15IG9w aW5pb24gdGhlcmUgd291bGQgYmUgaW50ZXJvcCBpc3N1ZXMgZnJvbSBkYXkgb25lLCBiZWNhdXNl IDEpIHdlIGFyZSDigJxzcGxpdHRpbmfigJ0gdGhlIGVuY29kZWQgSldTIHN0cmluZyBpbnRvIGRp ZmZlcmVudCBwaWVjZXMsIGFuZCAyKSBpdCBpcyBub3QgY2xlYXIgaG93IHRoZSBlbmNvZGluZyBv ZiB0aGF0IHdpbGwgbG9vayBsaWtlLg0KDQpNeSBzdWdnZXN0aW9uIGlzIHRvIHNlbmQgdGhlIHdo b2xlIGVuY29kZWQgUGFzc1BPUlQgSldTIG9iamVjdCBzdHJpbmcgYXMgdGhlIElkZW50aXR5IGhl YWRlciBmaWVsZCB2YWx1ZSwgYWNjb3JkaW5nIHRvIHRoZSBKV1Mgc3RhbmRhcmQsIGFuZCBkcm9w IHRoZSDigJxjYW5vbuKAnSBoZWFkZXIgZmllbGQgcGFyYW1ldGVyLiBUaGF0IHdhcyBteSBhc3N1 bXB0aW9uIHNpbmNlIHRoZSBkYXkgd2UgYWRvcHRlZCBKV1MuIEkgc3RpbGwgYWxsb3dzIG5vdCBz ZW5kaW5nIHRoZSBjbGFpbXMgaW4gYSBzdGFuZGFyZCBtYW5uZXIuIEkgYWxzbyBkb27igJl0IHRo aW5rIGl0IHNob3VsZCBiZSBhbGxvd2VkIHRvIGRyb3AgdGhlIG1hbmRhdG9yeSBKV1MgaGVhZGVy cy4NCg0KRG9pbmcgdGhlIGNoYW5nZSBpbiB0aGUgZHJhZnQgc2hvdWxkIG5vdCBiZSBhIGJpZyB0 YXNrLg0KDQpSZWdhcmRzLA0KDQpDaHJpc3Rlcg0KDQoNCg0KRnJvbTogUmljaGFyZCBTaG9ja2V5 IFttYWlsdG86cmljaGFyZEBzaG9ja2V5LnVzXQ0KU2VudDogMTYgSnVseSAyMDE2IDEzOjI5DQpU bzogQ2hyaXN0ZXIgSG9sbWJlcmcgPGNocmlzdGVyLmhvbG1iZXJnQGVyaWNzc29uLmNvbT47IFBl dGVyc29uLCBKb24gPGpvbi5wZXRlcnNvbkBuZXVzdGFyLmJpej4NCkNjOiBJRVRGIFNUSVIgTWFp bCBMaXN0IDxzdGlyQGlldGYub3JnPg0KU3ViamVjdDogUmU6IFtzdGlyXSBTZXBhcmF0aW9uIG9m IEpXUw0KDQoNCkNocmlzdGVyIGlmIHlvdSBhcmUgZnJ1c3RyYXRlZCBJIGNlcnRhaW5seSB1bmRl cnN0YW5kLg0KDQpBcyBJIGhhdmUgcmVhZCB0aHJvdWdoIHYxMCBoZXJlIEnigJltIHdvbmRlcmlu ZyBob3cgaXQgY2FuIGJlIHN1Y2Nlc3NmdWxseSBpbXBsZW1lbnRlZCBieSB0aGUgdmVuZG9yIGNv bW11bml0eS4gIFRoZXJlIGlzIGNsZWFybHkgc3Ryb25nLCBpbiBmYWN0IG92ZXJ3aGVsbWluZyBk ZW1hbmQgdG8gaW1wbGVtZW50IHRoaXMgYnV0IHRoZSBsYXN0IHRoaW5nIHdlIG5lZWQgYXJlIHRo ZSBraW5kcyBvZiBiYWtlZCBpbiBpbnRlcm9wZXJhYmlsaXR5IHByb2JsZW1zIHdlIGhhdmUgc2Vl biBpbiBWb0xURSwgZm9yIGluc3RhbmNlLiAgSSBjYW4gYXNzdXJlIHlvdSB0aGUgTlJB4oCZcyBo YXZlIGJlZW4gdG9sZCB3ZSBoYXZlIGEgc29sdXRpb24gYnV0IHdlIHJlYWxpc3RpY2FsbHkgbmVl ZCB0byBnaXZlIHRoZW0gc29tZSBpbXBsZW1lbnRhdGlvbiB0aW1lbGluZXMuDQoNClRoZSBsYWNr IG9mIGFjdHVhbCBmdWxsIGV4YW1wbGVzIG9mIGEgdHlwaWNhbCBvcmlnaW5hdGluZyBJTlZJVEUs IGlzIGFwcGFsbGluZy4gIEkgaGF2ZSBzZXJpb3VzIHF1ZXN0aW9ucyB3aGV0aGVyIHRoaXMgZG9j dW1lbnQgaXMgcmVhZHkgZm9yIGFkb3B0aW9uLg0KDQpTaG91bGQgd2UganVzdCBhY2NlcHQgd2hh dCB3ZSBoYXZlIG5vdz8gIFNob3VsZCB0aGUgU0lQIEZvcnVtIGltbWVkaWF0ZWx5IGxvb2sgaW50 byBzb21lIG9uZ29pbmcgcHJvZmlsZSB3b3JrIGhlcmUgYXMgd2Ugc3RhcnQgZG93biB0aGlzIHJv YWQ/ICAgSSBrbm93IFJvYmVydCB3b3VsZCBsaWtlIHRvIHNlZSBzb21lIGV4YW1wbGVzIG9mIGlt cGxlbWVudGF0aW9ucyBhdCBTSVBpdCBidXQgaXMgdGhlcmUgZW5vdWdoIHRpbWUgZ2l2ZW4gdGhl IG9uZ29pbmcgcXVlc3Rpb25zIHRoZSBkb2N1bWVudCBkb2VzIG5vdCBhbnN3ZXIuDQoNCg0KDQri gJQNClJpY2hhcmQgU2hvY2tleQ0KU2hvY2tleSBDb25zdWx0aW5nIExMQw0KQ2hhaXJtYW4gb2Yg dGhlIEJvYXJkIFNJUCBGb3J1bQ0Kd3d3LnNob2NrZXkudXM8aHR0cDovL3d3dy5zaG9ja2V5LnVz Pg0Kd3d3LnNpcGZvcnVtLm9yZzxodHRwOi8vd3d3LnNpcGZvcnVtLm9yZz4NCnJpY2hhcmQ8YXQ+ c2hvY2tleS51cw0KU2t5cGUtTGlua2VkaW4tRmFjZWJvb2sgcnNob2NrZXkxMDENClBTVE4gKzEg NzAzLTU5My0yNjgzDQoNCg0KRnJvbTogc3RpciA8c3Rpci1ib3VuY2VzQGlldGYub3JnPG1haWx0 bzpzdGlyLWJvdW5jZXNAaWV0Zi5vcmc+PiBvbiBiZWhhbGYgb2YgQ2hyaXN0ZXIgSG9sbWJlcmcg PGNocmlzdGVyLmhvbG1iZXJnQGVyaWNzc29uLmNvbTxtYWlsdG86Y2hyaXN0ZXIuaG9sbWJlcmdA ZXJpY3Nzb24uY29tPj4NCkRhdGU6IEZyaWRheSwgSnVseSAxNSwgMjAxNiBhdCA1OjM1IFBNDQpU bzogIlBldGVyc29uLCBKb24iIDxqb24ucGV0ZXJzb25AbmV1c3Rhci5iaXo8bWFpbHRvOmpvbi5w ZXRlcnNvbkBuZXVzdGFyLmJpej4+DQpDYzogSUVURiBTVElSIE1haWwgTGlzdCA8c3RpckBpZXRm Lm9yZzxtYWlsdG86c3RpckBpZXRmLm9yZz4+DQpTdWJqZWN0OiBSZTogW3N0aXJdIFNlcGFyYXRp b24gb2YgSldTDQoNCkhpLA0KDQo+T2gsIHlvdSBtZWFudCBBcHBlbmRpeCBGIG9mIFJGQzc1MTUu IEkgaGFkIHRob3VnaHQgeW91IHNhaWQgUkZDNzMxNSBpbiB5b3VyIG90aGVyIG1haWwsIHNvIHBl cmhhcHMgeW91IGNhbiB1bmRlcnN0YW5kIG15IGNvbmZ1c2lvbi4NCg0KU29ycnkgOikNCg0KPk15 IHJlYWRpbmcgb2YgdGhhdCBpcyB0aGF0IGl0IGNhbiByZW1vdmUgdGhlIGNsYWltcyBidXQgbm90 IHRoZSBoZWFkZXIuIEJ1dCBpdCdzIGFsc28gbm90IHN1cGVyIHNwZWNpZmljIGFib3V0IGhvdyBp dCB3b3Jrcy4NCg0KV2hhdCBkbyB5b3UgdGhpbmsgaXMgdW5jbGVhcj8NCg0KSSBhbSB1c2luZyBp dCBmb3IgYSBkcmFmdCBJ4oCZbSB3b3JraW5nIG9uLCBhbmQgSSB0aGluayBpdOKAmXMgcHJldHR5 IGNsZWFyIDopDQoNCkkgYW0gYWxzbyBub3Qgc3VyZSB3aHkgd2Ugc2hvdWxkIHJlbW92ZSB0aGUg aGVhZGVycy4gRG9u4oCZdCB3ZSBuZWVkIHRoYXQgaW5mb3JtYXRpb24/DQoNCj41LjIuMSBvZiBy ZmM0NDc0YmlzLTEwIGNvbnRhaW5zIHRoZSBjcmlzcGVzdCBzdGF0ZW1lbnQgb2YgdGhlIHN5bnRh eCBvZiBjYW5vbiwgcGVyaGFwcywgYnV0IGl0IGlzIG5vdCB0aGUgam9iIG9mIHJmYzQ0NzRiaXMg dG8gcmVwZWF0IHRoZSBndWlkYW5jZSBvZg0KPlBBU1Nwb3JUIG9uIGhvdyB0byBjb25zdHJ1Y3Qg dGhlIG9iamVjdC4gUGVyaGFwcyBhIHBvaW50ZXIgdG8gdGhhdCBzcGVjaWZpYyBzZWN0aW9uIG9m IFBBU1Nwb3JUIHdvdWxkIGhlbHA/DQoNCk15IHF1ZXN0aW9uIGlzIG5vdCBob3cgdG8gY29uc3Ry dWN0IHRoZSBvYmplY3QsIGJ1dCBob3cgdG8gY29uc3RydWN0IHRoZSDigJxjYW5vbuKAnSBoZWFk ZXIgZmllbGQgdmFsdWUsIHdoaWNoIHNlZW1zIHRvIGJlIG9ubHkgYSBwYXJ0IG9mIHRoZSBvYmpl Y3Qgc3RyaW5nLg0KDQpTZWN0aW9uIDUuMi4xIGRlc2NyaWJlcyB3aGljaCBjb21wb25lbnRzICho ZWFkZXJzIGFuZCBjbGFpbXMpIGFyZSB1c2VkIHRvIGNyZWF0ZSB0aGUg4oCcY2Fub27igJ0gdmFs dWUsIGJ1dCBub3cgSE9XIGl04oCZcyBjcmVhdGVkLg0KDQpTbywgSeKAmWQgbGlrZSB0byBzdWdn ZXN0IHRoYXQgd2UgdHJhbnNwb3J0IHRoZSBQQVNTcG9ydFQgb2JqZWN0IHN0cmluZyBhcyB0aGUg SWRlbnRpdHkgaGVhZGVyIGZpZWxkIHZhbHVlLCBhbmQgZG9u4oCZdCB1c2Ug4oCcY2Fub27igJ0u IEkgYW0gaGFwcHkgdG8gaGVhciB3aHkgd2UgY2Fu4oCZdCBkbyB0aGF0LCBidXQgc28gZmFyIEkg aGF2ZSBub3QgaGVhcmQvcmVhZCBhbnl0aGluZyA6KQ0KDQpUaGF0IHdvdWxkIGFsc28gYWxsb3cg cGVvcGxlIHRvIHVzZSBvZmYtdGhlLXNoZWxmIEpXUyBlbmNvZGVycy9kZWNvZGVycywgYW5kIHdl IHdvdWxkIGF2b2lkIHRoZSBjb25mdXNpb24gb2YgdHJhbnNwb3J0aW5nIGRpZmZlcmVudCBwYXJ0 cyBvZiB0aGUgb2JqZWN0IHN0cmluZyBpbiBkaWZmZXJlbnQgcGxhY2VzLg0KDQpSZWdhcmRzLA0K DQpDaHJpc3Rlcg0KDQoNCk9uIEp1bCAxNSwgMjAxNiwgYXQgMjowOSBBTSwgQ2hyaXN0ZXIgSG9s bWJlcmcgPGNocmlzdGVyLmhvbG1iZXJnQGVyaWNzc29uLmNvbTxtYWlsdG86Y2hyaXN0ZXIuaG9s bWJlcmdAZXJpY3Nzb24uY29tPj4gd3JvdGU6DQpIaSwNCg0KPiBUaGlzIGlzIHBhcnRseSB0aGUg c2FtZSBxdWVzdGlvbiBhcyB3ZSBhcmUgZXhwbG9yaW5nIGluIHRoZSAic3ludGF4IGNoYW5nZSIg dGhyZWFkIGRpc2N1c3Npb24gb24gd2hldGhlciBvciBub3QgImNhbm9uIiB3aWxsIGFsd2F5cyBi ZSBpbmNsdWRlZC4NCg0KSXTigJlzIG5vdCByZWFsbHkgdGhlIHNhbWUuIE15IHF1ZXN0aW9uIGlz OiAqSUYqIHRoZSBjbGFpbXMgYXJlIGluY2x1ZGVkLCB3aHkgZG8gd2UgcHV0IHRoZW0gaW4gYSBz ZXBhcmF0ZSBwbGFjZSAodGhlIOKAnGNhbm9u4oCdIGhlYWRlciBmaWVsZCBwYXJhbWV0ZXIpPyBX aHkgZG9u4oCZdCB3ZSB1c2UgdGhlIHN0YW5kYXJkIEpXUyBtZWNoYW5pc20/DQoNCj5UbyBhbnN3 ZXIgeW91ciBxdWVzdGlvbiwgdGhpbmsgYWJvdXQgaXQgYXMgaWYgU0lQIGRvZXMgbm90IGNhcnJ5 IGEgSldTIG9iamVjdCwgYnV0IGluc3RlYWQgaXQgdHJhbnNwb3J0cyBzb21lIGRhdGEgdGhhdCBh bGxvd3MgYSB2ZXJpZmljYXRpb24gc2VydmljZQ0KPnRvIGdlbmVyYXRlIGEgSldTIG9iamVjdC4g U28gd2UncmUgbm90ICJzZW5kaW5nIiB0aGUgSldTIG9iamVjdCwgYW5kIHRodXMgd2UncmUgdW5k ZXIgbm8gb2JsaWdhdGlvbiB0byAic2VuZCBpdCBhcyBvbmUgc3RyaW5nIiBvciB3aGF0ZXZlci4N Cj4NCj5UaGUgcmZjNDQ3NGJpcyAiY2Fub24iIHBhcmFtZXRlciBvcHRpb25hbGx5IGNvbnRhaW5z IHRoZSBlbmNvZGVkIHBvcnRpb24gb2YgdGhlIGhlYWRlciBhbmQgY2xhaW1zIG9mIHRoZSBKV1Mg b2JqZWN0IGJlY2F1c2UgdGhlIGhlYWRlcnMgKGFuZCBjbGFpbXMpIGluIGJhc2VsaW5lIFBBU1Nw b3JUIGFyZSB1c3VhbGx5IHJlZHVuZGFudCB3dGggdGhlIGNvbnRlbnRzIG9mID5hIFNJUCByZXF1 ZXN0IC0gd2UgYW50aWNpcGF0ZSB0aGF0IGFueSB2ZXJpZmljYXRpb24gc2VydmljZSBjYW4gb3Jk aW5hcmlseSByZWdlbmVyYXRlIHRob3NlIGhlYWRlcnMgYW5kIGNsYWltcyBpdHNlbGYsIHNvLCB0 aGVyZSdzIG5vIG9zdGVuc2libGUgdmFsdWUgaW4gY2FycnlpbmcgdGhlbS4gR2VuZXJhbGx5IHNw ZWFraW5nLCB3ZSBzaG91bGQgYmxvYXRpbmcgbWVzc2FnZXMgPndpdGggcmVkdW5kYW50IGZpZWxk cyBpZiB3ZSBjYW4uDQoNCkkgYWdyZWUuIEJ1dCwgQXBwZW5kaXggRiBkZXNjcmliZXMgaG93IHRv IGRvIHRoYXQgd2l0aCBKV1MuDQoNCj5JZiB5b3UncmUgYXNraW5nIHdoeSB3ZSBjaG9zZSB0byBk ZW1hcmNhdGUgdGhhdCB3aXRoICJjYW5vbiIgcmF0aGVyIHRoYW4ganVzdCBub3QgaW5jbHVkaW5n IHRoZSBKV1MgaGVhZGVyIGFuZCBjbGFpbXMgaWYgd2UgZGlkbid0DQo+d2FudCB0byBpbmNsdWRl IHRoZSBKV1MgaGVhZGVyIGFuZCBjbGFpbXMsIGl0IGlzIGdlbmVyYWxseSBiZXR0ZXIgdG8gYmUg ZXhwbGljaXQgdGhhbiB0byBsZWF2ZSB0aGUgdmVyaWZpY2F0aW9uIHNlcnZpY2UgdG8gaW5mZXIg d2hhdCBpcyBnb2luZy4NCg0KSW4gbXkgb3BpbmlvbiBpdOKAmXMgYmV0dGVyIHRvIGZvbGxvdyB0 aGUgc3RhbmRhcmQuIEFuZCwgYWdhaW4sIEFwcGVuZGl4IEYgZGVzY3JpYmVzIGhvdyB0byBub3Qg aW5jbHVkZWQgdGhlIGNsYWltcyBpbiBhIHN0YW5kYXJkIHdheS4NCg0KQWxzbywgSSBhbSBub3Qg c3VyZSAobmVlZCB0byB2ZXJpZnkpIHdoZXRoZXIgaXTigJlzIGFsbG93ZWQgdG8gcmVtb3ZlIGFs bCBoZWFkZXJzLg0KDQpBbHNvLCAqSUYqIHdlIHdhbnQgdG8gdXNlIHRoZSDigJxjYW5vbuKAnSBo ZWFkZXIgZmllbGQgcGFyYW1ldGVyLCB0aGUgZHJhZnQgZG9lc27igJl0IGdpdmUgZW5vdWdoIGlu Zm9ybWF0aW9uIG9uIGhvdyBpdCBpcyBnZW5lcmF0ZWQuDQoNCldlIGhhdmUgdGhlIGZvbGxvd2lu ZyBzeW50YXggaW4gU2VjdGlvbiA4Og0KDQpjYW5vbmljYWwtc3RyID0gImNhbm9uIiBFUVVBTCAq YmFzZTY0LWNoYXINCg0K4oCmYW5kLCBpbiBhIGZldyBwbGFjZXMgb2YgdGhlIGRvY3VtZW50IHdl IGhhdmUgdGV4dCBsaWtlOg0KDQrigJxUaGUgc3ludGF4IG9mICJjYW5vbiIgaXMgZ2l2ZW4gaW4g U2VjdGlvbiA4OyBlc3NlbnRpYWxseSwgaXQgY29udGFpbnMgYSBiYXNlNjQNCiAgICAgICAgICAg ICAgZW5jb2Rpbmcgb2YgdGhlIEpTT04gaGVhZGVyIGFuZCBjbGFpbXMgaW4gdGhlIFBBU1Nwb3JU IG9iamVjdC7igJ0NCg0KQnV0LCBJIGNhbm5vdCBmaW5kIHRleHQgb24gaG93IHRoYXQgYmFzZTY0 LWNoYXIgc3RyaW5nIGlzIGdlbmVyYXRlZC4gWW91IGhhdmUgdGhlIGJhc2U2NCBlbmNvZGluZyBv ZiB0aGUgSlNPTiBoZWFkZXIsIGFuZCB0aGUgYmFzZTY0IGVuY29kaW5nIG9mIHRoZSBjbGFpbXMu IEhvdyBkbyB5b3UgY29tYmluZSB0aGVtIGludG8gdGhlIGJhc2U2NCBlbmNvZGVkIOKAnGNhbm9u 4oCdIHZhbHVlPw0KDQpSZWdhcmRzLA0KDQpDaHJpc3Rlcg0KDQpfX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fXyBzdGlyIG1haWxpbmcgbGlzdCBzdGlyQGlldGYu b3JnPG1haWx0bzpzdGlyQGlldGYub3JnPiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xp c3RpbmZvL3N0aXINCg== --_000_7594FB04B1934943A5C02806D1A2204B476BD10CESESSMB209erics_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjojMDU2M0MxOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFu Lk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjoj OTU0RjcyOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KcC5Nc29MaXN0UGFyYWdyYXBo LCBsaS5Nc29MaXN0UGFyYWdyYXBoLCBkaXYuTXNvTGlzdFBhcmFncmFwaA0KCXttc28tc3R5bGUt cHJpb3JpdHk6MzQ7DQoJbWFyZ2luLXRvcDowY207DQoJbWFyZ2luLXJpZ2h0OjBjbTsNCgltYXJn aW4tYm90dG9tOjBjbTsNCgltYXJnaW4tbGVmdDozNi4wcHQ7DQoJbWFyZ2luLWJvdHRvbTouMDAw MXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2Vy aWY7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTgNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9u dC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQpzcGFu LkVtYWlsU3R5bGUxOQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToi Q2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMUY0OTdEO30NCnNwYW4uRW1haWxTdHlsZTIw DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5z LXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjENCgl7bXNvLXN0 eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJ Y29sb3I6IzFGNDk3RDt9DQpzcGFuLkVtYWlsU3R5bGUyMg0KCXttc28tc3R5bGUtdHlwZTpwZXJz b25hbDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0 ZXh0O30NCnNwYW4uRW1haWxTdHlsZTIzDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0Kc3Bh bi5FbWFpbFN0eWxlMjQNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6 IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6IzFGNDk3RDt9DQpzcGFuLkVtYWlsU3R5bGUy NQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1jb21wb3NlOw0KCWZvbnQtZmFtaWx5OiJDYWxp YnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7 bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBX b3JkU2VjdGlvbjENCgl7c2l6ZTo2MTIuMHB0IDc5Mi4wcHQ7DQoJbWFyZ2luOjcyLjBwdCA3Mi4w cHQgNzIuMHB0IDcyLjBwdDt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24x O30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRz IHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtp ZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1h cCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRp Zl0tLT4NCjwvaGVhZD4NCjxib2R5IGJnY29sb3I9IndoaXRlIiBsYW5nPSJFTi1HQiIgbGluaz0i IzA1NjNDMSIgdmxpbms9IiM5NTRGNzIiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEO21zby1mYXJlYXN0 LWxhbmd1YWdlOkVOLVVTIj5IaSw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RDttc28tZmFyZWFzdC1sYW5ndWFnZTpF Ti1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0Q7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPkkg YW0gY29tbWVudGluZyB3aXRoIGFuIGltcGxlbWVudGVyIGhhdCBvbiwgYW5kIEkgZG9u4oCZdCB0 aGluayB3ZSBzaG91bGQgYWNjZXB0IHdoYXQgd2UgaGF2ZSBub3cuIEluIG15IG9waW5pb24gdGhl cmUgd291bGQgYmUgaW50ZXJvcCBpc3N1ZXMgZnJvbSBkYXkgb25lLCBiZWNhdXNlIDEpIHdlIGFy ZSDigJxzcGxpdHRpbmfigJ0NCiB0aGUgZW5jb2RlZCBKV1Mgc3RyaW5nIGludG8gZGlmZmVyZW50 IHBpZWNlcywgYW5kIDIpIGl0IGlzIG5vdCBjbGVhciBob3cgdGhlIGVuY29kaW5nIG9mIHRoYXQg d2lsbCBsb29rIGxpa2UuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0Q7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMi PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJjb2xvcjojMUY0OTdEO21zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj5NeSBzdWdn ZXN0aW9uIGlzIHRvIHNlbmQgdGhlIHdob2xlIGVuY29kZWQgUGFzc1BPUlQgSldTIG9iamVjdCBz dHJpbmcgYXMgdGhlIElkZW50aXR5IGhlYWRlciBmaWVsZCB2YWx1ZSwgYWNjb3JkaW5nIHRvIHRo ZSBKV1Mgc3RhbmRhcmQsIGFuZCBkcm9wIHRoZSDigJxjYW5vbuKAnSBoZWFkZXIgZmllbGQgcGFy YW1ldGVyLg0KIFRoYXQgd2FzIG15IGFzc3VtcHRpb24gc2luY2UgdGhlIGRheSB3ZSBhZG9wdGVk IEpXUy4gSSBzdGlsbCBhbGxvd3Mgbm90IHNlbmRpbmcgdGhlIGNsYWltcyBpbiBhIHN0YW5kYXJk IG1hbm5lci4gSSBhbHNvIGRvbuKAmXQgdGhpbmsgaXQgc2hvdWxkIGJlIGFsbG93ZWQgdG8gZHJv cCB0aGUgbWFuZGF0b3J5IEpXUyBoZWFkZXJzLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEO21zby1mYXJlYXN0LWxh bmd1YWdlOkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RDttc28tZmFyZWFzdC1sYW5ndWFnZTpF Ti1VUyI+RG9pbmcgdGhlIGNoYW5nZSBpbiB0aGUgZHJhZnQgc2hvdWxkIG5vdCBiZSBhIGJpZyB0 YXNrLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJjb2xvcjojMUY0OTdEO21zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29s b3I6IzFGNDk3RDttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+UmVnYXJkcyw8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzFG NDk3RDttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0Q7bXNv LWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPkNocmlzdGVyPG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0Q7bXNvLWZhcmVh c3QtbGFuZ3VhZ2U6RU4tVVMiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEO21zby1mYXJlYXN0LWxhbmd1YWdlOkVO LVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RDttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGEgbmFtZT0i X01haWxFbmRDb21wb3NlIj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RDttc28tZmFyZWFzdC1s YW5ndWFnZTpFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9hPjwvcD4NCjxkaXY+DQo8 ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFk ZGluZzozLjBwdCAwY20gMGNtIDBjbSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBs YW5nPSJFTi1VUyI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIGxhbmc9IkVOLVVTIj4gUmljaGFyZCBT aG9ja2V5IFttYWlsdG86cmljaGFyZEBzaG9ja2V5LnVzXQ0KPGJyPg0KPGI+U2VudDo8L2I+IDE2 IEp1bHkgMjAxNiAxMzoyOTxicj4NCjxiPlRvOjwvYj4gQ2hyaXN0ZXIgSG9sbWJlcmcgJmx0O2No cmlzdGVyLmhvbG1iZXJnQGVyaWNzc29uLmNvbSZndDs7IFBldGVyc29uLCBKb24gJmx0O2pvbi5w ZXRlcnNvbkBuZXVzdGFyLmJpeiZndDs8YnI+DQo8Yj5DYzo8L2I+IElFVEYgU1RJUiBNYWlsIExp c3QgJmx0O3N0aXJAaWV0Zi5vcmcmZ3Q7PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbc3Rpcl0g U2VwYXJhdGlvbiBvZiBKV1M8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiPkNocmlzdGVyIGlmIHlvdSBh cmUgZnJ1c3RyYXRlZCBJIGNlcnRhaW5seSB1bmRlcnN0YW5kLiZuYnNwOyZuYnNwOw0KPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMi PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IGxhbmc9IkVOLVVTIj5BcyBJIGhhdmUgcmVhZCB0aHJvdWdoIHYxMCBoZXJlIEnigJltIHdvbmRl cmluZyBob3cgaXQgY2FuIGJlIHN1Y2Nlc3NmdWxseSBpbXBsZW1lbnRlZCBieSB0aGUgdmVuZG9y IGNvbW11bml0eS4mbmJzcDsgVGhlcmUgaXMgY2xlYXJseSBzdHJvbmcsIGluIGZhY3Qgb3Zlcndo ZWxtaW5nIGRlbWFuZCB0byBpbXBsZW1lbnQgdGhpcyBidXQgdGhlIGxhc3QgdGhpbmcgd2UgbmVl ZCBhcmUgdGhlDQoga2luZHMgb2YgYmFrZWQgaW4gaW50ZXJvcGVyYWJpbGl0eSBwcm9ibGVtcyB3 ZSBoYXZlIHNlZW4gaW4gVm9MVEUsIGZvciBpbnN0YW5jZS4gJm5ic3A7SSBjYW4gYXNzdXJlIHlv dSB0aGUgTlJB4oCZcyBoYXZlIGJlZW4gdG9sZCB3ZSBoYXZlIGEgc29sdXRpb24gYnV0IHdlIHJl YWxpc3RpY2FsbHkgbmVlZCB0byBnaXZlIHRoZW0gc29tZSBpbXBsZW1lbnRhdGlvbiB0aW1lbGlu ZXMuDQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBs YW5nPSJFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiPlRoZSBsYWNrIG9mIGFjdHVhbCBmdWxsIGV4YW1wbGVz IG9mIGEgdHlwaWNhbCBvcmlnaW5hdGluZyBJTlZJVEUsIGlzIGFwcGFsbGluZy4gJm5ic3A7SSBo YXZlIHNlcmlvdXMgcXVlc3Rpb25zIHdoZXRoZXIgdGhpcyBkb2N1bWVudCBpcyByZWFkeSBmb3Ig YWRvcHRpb24uJm5ic3A7DQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBsYW5nPSJFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiPlNob3VsZCB3ZSBqdXN0IGFjY2Vw dCB3aGF0IHdlIGhhdmUgbm93PyZuYnNwOyBTaG91bGQgdGhlIFNJUCBGb3J1bSBpbW1lZGlhdGVs eSBsb29rIGludG8gc29tZSBvbmdvaW5nIHByb2ZpbGUgd29yayBoZXJlIGFzIHdlIHN0YXJ0IGRv d24gdGhpcyByb2FkPyAmbmJzcDsmbmJzcDtJIGtub3cgUm9iZXJ0IHdvdWxkIGxpa2UgdG8gc2Vl IHNvbWUgZXhhbXBsZXMgb2YgaW1wbGVtZW50YXRpb25zIGF0IFNJUGl0DQogYnV0IGlzIHRoZXJl IGVub3VnaCB0aW1lIGdpdmVuIHRoZSBvbmdvaW5nIHF1ZXN0aW9ucyB0aGUgZG9jdW1lbnQgZG9l cyBub3QgYW5zd2VyLg0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gbGFuZz0iRU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6ZToxMC41cHQ7Y29sb3I6YmxhY2siPuKA lCZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdDtjb2xv cjpibGFjayI+UmljaGFyZCBTaG9ja2V5PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250 LXNpemU6MTAuNXB0O2NvbG9yOmJsYWNrIj5TaG9ja2V5IENvbnN1bHRpbmcgTExDPG86cD48L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g bGFuZz0iRU4tVVMiIHN0eWxlPSJmb250LXNpemU6MTAuNXB0O2NvbG9yOmJsYWNrIj5DaGFpcm1h biBvZiB0aGUgQm9hcmQgU0lQIEZvcnVtPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250 LXNpemU6MTAuNXB0O2NvbG9yOmJsYWNrIj48YSBocmVmPSJodHRwOi8vd3d3LnNob2NrZXkudXMi Pnd3dy5zaG9ja2V5LnVzPC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXpl OjEwLjVwdDtjb2xvcjpibGFjayI+PGEgaHJlZj0iaHR0cDovL3d3dy5zaXBmb3J1bS5vcmciPnd3 dy5zaXBmb3J1bS5vcmc8L2E+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250LXNpemU6 MTAuNXB0O2NvbG9yOmJsYWNrIj5yaWNoYXJkJmx0O2F0Jmd0O3Nob2NrZXkudXM8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBs YW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6ZToxMC41cHQ7Y29sb3I6YmxhY2siPlNreXBlLUxp bmtlZGluLUZhY2Vib29rIHJzaG9ja2V5MTAxPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJm b250LXNpemU6MTAuNXB0O2NvbG9yOmJsYWNrIj5QU1ROICYjNDM7MSA3MDMtNTkzLTI2ODM8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gbGFuZz0iRU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNCNUM0REYgMS4w cHQ7cGFkZGluZzozLjBwdCAwY20gMGNtIDBjbSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48 c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImNvbG9yOmJsYWNrIj5Gcm9tOiA8L3NwYW4+PC9iPjxz cGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iY29sb3I6YmxhY2siPnN0aXIgJmx0OzxhIGhyZWY9Im1h aWx0bzpzdGlyLWJvdW5jZXNAaWV0Zi5vcmciPnN0aXItYm91bmNlc0BpZXRmLm9yZzwvYT4mZ3Q7 IG9uIGJlaGFsZiBvZiBDaHJpc3RlciBIb2xtYmVyZyAmbHQ7PGEgaHJlZj0ibWFpbHRvOmNocmlz dGVyLmhvbG1iZXJnQGVyaWNzc29uLmNvbSI+Y2hyaXN0ZXIuaG9sbWJlcmdAZXJpY3Nzb24uY29t PC9hPiZndDs8YnI+DQo8Yj5EYXRlOiA8L2I+RnJpZGF5LCBKdWx5IDE1LCAyMDE2IGF0IDU6MzUg UE08YnI+DQo8Yj5UbzogPC9iPiZxdW90O1BldGVyc29uLCBKb24mcXVvdDsgJmx0OzxhIGhyZWY9 Im1haWx0bzpqb24ucGV0ZXJzb25AbmV1c3Rhci5iaXoiPmpvbi5wZXRlcnNvbkBuZXVzdGFyLmJp ejwvYT4mZ3Q7PGJyPg0KPGI+Q2M6IDwvYj5JRVRGIFNUSVIgTWFpbCBMaXN0ICZsdDs8YSBocmVm PSJtYWlsdG86c3RpckBpZXRmLm9yZyI+c3RpckBpZXRmLm9yZzwvYT4mZ3Q7PGJyPg0KPGI+U3Vi amVjdDogPC9iPlJlOiBbc3Rpcl0gU2VwYXJhdGlvbiBvZiBKV1M8L3NwYW4+PHNwYW4gbGFuZz0i RU4tVVMiIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5n PSJFTi1VUyIgc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90Oyxz ZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj5IaSw8L3Nw YW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpw PjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jmd0O09oLCB5b3UgbWVh bnQgQXBwZW5kaXggRiBvZiBSRkM3NTE1LiBJIGhhZCB0aG91Z2h0IHlvdSBzYWlkIFJGQzczMTUg aW4geW91ciBvdGhlciBtYWlsLCBzbyBwZXJoYXBzIHlvdSBjYW4gdW5kZXJzdGFuZCBteSBjb25m dXNpb24uICZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7 PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Tb3JyeSA6KTxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mZ3Q7TXkgcmVhZGlu ZyBvZiB0aGF0IGlzIHRoYXQgaXQgY2FuIHJlbW92ZSB0aGUgY2xhaW1zIGJ1dCBub3QgdGhlIGhl YWRlci4gQnV0IGl0J3MgYWxzbyBub3Qgc3VwZXIgc3BlY2lmaWMgYWJvdXQgaG93IGl0IHdvcmtz LiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5XaGF0IGRvIHlvdSB0aGluayBpcyB1bmNs ZWFyPzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JIGFtIHVzaW5nIGl0IGZvciBhIGRyYWZ0IEni gJltIHdvcmtpbmcgb24sIGFuZCBJIHRoaW5rIGl04oCZcyBwcmV0dHkgY2xlYXIgOik8bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+SSBhbSBhbHNvIG5vdCBzdXJlIHdoeSB3ZSBzaG91bGQgcmVtb3Zl IHRoZSBoZWFkZXJzLiBEb27igJl0IHdlIG5lZWQgdGhhdCBpbmZvcm1hdGlvbj88bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jmd0OzUuMi4xIG9m IHJmYzQ0NzRiaXMtMTAgY29udGFpbnMgdGhlIGNyaXNwZXN0IHN0YXRlbWVudCBvZiB0aGUgc3lu dGF4IG9mIGNhbm9uLCBwZXJoYXBzLCBidXQgaXQgaXMgbm90IHRoZSBqb2Igb2YgcmZjNDQ3NGJp cyB0byByZXBlYXQgdGhlIGd1aWRhbmNlIG9mDQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPiZndDtQQVNTcG9yVCBvbiBob3cgdG8gY29uc3RydWN0IHRoZSBvYmplY3QuIFBl cmhhcHMgYSBwb2ludGVyIHRvIHRoYXQgc3BlY2lmaWMgc2VjdGlvbiBvZiBQQVNTcG9yVCB3b3Vs ZCBoZWxwPzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5NeSBxdWVzdGlvbiBpcyBub3QgaG93IHRv IGNvbnN0cnVjdCB0aGUgb2JqZWN0LCBidXQgaG93IHRvIGNvbnN0cnVjdCB0aGUg4oCcY2Fub27i gJ0gaGVhZGVyIGZpZWxkIHZhbHVlLCB3aGljaCBzZWVtcyB0byBiZSBvbmx5IGEgcGFydCBvZiB0 aGUgb2JqZWN0IHN0cmluZy4NCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5TZWN0aW9uIDUuMi4x IGRlc2NyaWJlcyB3aGljaCBjb21wb25lbnRzIChoZWFkZXJzIGFuZCBjbGFpbXMpIGFyZSB1c2Vk IHRvIGNyZWF0ZSB0aGUg4oCcY2Fub27igJ0gdmFsdWUsIGJ1dCBub3cgSE9XIGl04oCZcyBjcmVh dGVkLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5TbywgSeKAmWQgbGlrZSB0byBzdWdnZXN0IHRo YXQgd2UgdHJhbnNwb3J0IHRoZSBQQVNTcG9ydFQgb2JqZWN0IHN0cmluZyBhcyB0aGUgSWRlbnRp dHkgaGVhZGVyIGZpZWxkIHZhbHVlLCBhbmQgZG9u4oCZdCB1c2Ug4oCcY2Fub27igJ0uIEkgYW0g aGFwcHkgdG8gaGVhciB3aHkgd2UgY2Fu4oCZdCBkbyB0aGF0LCBidXQgc28gZmFyIEkgaGF2ZSBu b3QgaGVhcmQvcmVhZCBhbnl0aGluZyA6KTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGF0IHdv dWxkIGFsc28gYWxsb3cgcGVvcGxlIHRvIHVzZSBvZmYtdGhlLXNoZWxmIEpXUyBlbmNvZGVycy9k ZWNvZGVycywgYW5kIHdlIHdvdWxkIGF2b2lkIHRoZSBjb25mdXNpb24gb2YgdHJhbnNwb3J0aW5n IGRpZmZlcmVudCBwYXJ0cyBvZiB0aGUgb2JqZWN0IHN0cmluZyBpbiBkaWZmZXJlbnQgcGxhY2Vz LjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5SZWdhcmRzLDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5DaHJpc3RlcjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWJvdHRvbToxMi4wcHQiPjxicj4NCk9uIEp1bCAxNSwgMjAxNiwgYXQgMjowOSBBTSwg Q2hyaXN0ZXIgSG9sbWJlcmcgJmx0OzxhIGhyZWY9Im1haWx0bzpjaHJpc3Rlci5ob2xtYmVyZ0Bl cmljc3Nvbi5jb20iPmNocmlzdGVyLmhvbG1iZXJnQGVyaWNzc29uLmNvbTwvYT4mZ3Q7IHdyb3Rl OjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1 LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+SGksPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuNXB0O2Nv bG9yOmJsYWNrIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdCI+Jmd0OyA8 c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPlRoaXMgaXMgcGFydGx5IHRoZSBzYW1lIHF1ZXN0aW9u IGFzIHdlIGFyZSBleHBsb3JpbmcgaW4gdGhlICZxdW90O3N5bnRheCBjaGFuZ2UmcXVvdDsgdGhy ZWFkIGRpc2N1c3Npb24gb24gd2hldGhlciBvciBub3QgJnF1b3Q7Y2Fub24mcXVvdDsgd2lsbCBh bHdheXMgYmUgaW5jbHVkZWQuPC9zcGFuPjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ SXTigJlzIG5vdCByZWFsbHkgdGhlIHNhbWUuIE15IHF1ZXN0aW9uIGlzOiAqPGI+SUY8L2I+KiB0 aGUgY2xhaW1zIGFyZSBpbmNsdWRlZCwgd2h5IGRvIHdlIHB1dCB0aGVtIGluIGEgc2VwYXJhdGUg cGxhY2UgKHRoZSDigJxjYW5vbuKAnSBoZWFkZXIgZmllbGQgcGFyYW1ldGVyKT8gV2h5IGRvbuKA mXQgd2UgdXNlIHRoZSBzdGFuZGFyZCBKV1MgbWVjaGFuaXNtPzxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MC41cHQ7Y29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuNXB0 Ij4mZ3Q7PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5UbyBhbnN3ZXIgeW91ciBxdWVzdGlvbiwg dGhpbmsgYWJvdXQgaXQgYXMgaWYgU0lQIGRvZXMgbm90IGNhcnJ5IGEgSldTIG9iamVjdCwgYnV0 IGluc3RlYWQgaXQgdHJhbnNwb3J0cyBzb21lIGRhdGEgdGhhdCBhbGxvd3MgYSB2ZXJpZmljYXRp b24gc2VydmljZQ0KPC9zcGFuPjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPiZndDs8c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdDtjb2xvcjpibGFjayI+dG8g Z2VuZXJhdGUgYSBKV1Mgb2JqZWN0LiBTbyB3ZSdyZSBub3QgJnF1b3Q7c2VuZGluZyZxdW90OyB0 aGUgSldTIG9iamVjdCwgYW5kIHRodXMgd2UncmUgdW5kZXIgbm8gb2JsaWdhdGlvbiB0byAmcXVv dDtzZW5kIGl0IGFzIG9uZSBzdHJpbmcmcXVvdDsgb3Igd2hhdGV2ZXIuPC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMC41cHQiPiZndDs8c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPiZuYnNwOzwv c3Bhbj48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdCI+Jmd0OzxzcGFuIHN0eWxlPSJj b2xvcjpibGFjayI+VGhlIHJmYzQ0NzRiaXMgJnF1b3Q7Y2Fub24mcXVvdDsgcGFyYW1ldGVyIG9w dGlvbmFsbHkgY29udGFpbnMgdGhlIGVuY29kZWQgcG9ydGlvbiBvZiB0aGUgaGVhZGVyIGFuZCBj bGFpbXMgb2YgdGhlIEpXUyBvYmplY3QgYmVjYXVzZSB0aGUgaGVhZGVycyAoYW5kIGNsYWltcykg aW4gYmFzZWxpbmUgUEFTU3BvclQgYXJlIHVzdWFsbHkNCiByZWR1bmRhbnQgd3RoIHRoZSBjb250 ZW50cyBvZiA8L3NwYW4+Jmd0OzxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+YSBTSVAgcmVxdWVz dCAtIHdlIGFudGljaXBhdGUgdGhhdCBhbnkgdmVyaWZpY2F0aW9uIHNlcnZpY2UgY2FuIG9yZGlu YXJpbHkgcmVnZW5lcmF0ZSB0aG9zZSBoZWFkZXJzIGFuZCBjbGFpbXMgaXRzZWxmLCBzbywgdGhl cmUncyBubyBvc3RlbnNpYmxlIHZhbHVlIGluIGNhcnJ5aW5nIHRoZW0uIEdlbmVyYWxseSBzcGVh a2luZywgd2UNCiBzaG91bGQgYmxvYXRpbmcgbWVzc2FnZXMgPC9zcGFuPiZndDs8c3BhbiBzdHls ZT0iY29sb3I6YmxhY2siPndpdGggcmVkdW5kYW50IGZpZWxkcyBpZiB3ZSBjYW4uJm5ic3A7PC9z cGFuPjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuNXB0Ij4mbmJzcDs8L3NwYW4+PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JIGFncmVlLiBCdXQsIEFwcGVuZGl4IEYg ZGVzY3JpYmVzIGhvdyB0byBkbyB0aGF0IHdpdGggSldTLiA8bzpwPg0KPC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdCI+Jmd0Ozxz cGFuIHN0eWxlPSJjb2xvcjpibGFjayI+SWYgeW91J3JlIGFza2luZyB3aHkgd2UgY2hvc2UgdG8g ZGVtYXJjYXRlIHRoYXQgd2l0aCAmcXVvdDtjYW5vbiZxdW90OyByYXRoZXIgdGhhbiBqdXN0IG5v dCBpbmNsdWRpbmcgdGhlIEpXUyBoZWFkZXIgYW5kIGNsYWltcyBpZiB3ZSBkaWRuJ3QNCjwvc3Bh bj48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mZ3Q7PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMC41cHQ7Y29sb3I6YmxhY2siPndhbnQgdG8gaW5jbHVkZSB0aGUg SldTIGhlYWRlciBhbmQgY2xhaW1zLCBpdCBpcyBnZW5lcmFsbHkgYmV0dGVyIHRvIGJlIGV4cGxp Y2l0IHRoYW4gdG8gbGVhdmUgdGhlIHZlcmlmaWNhdGlvbiBzZXJ2aWNlIHRvIGluZmVyIHdoYXQg aXMgZ29pbmcuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC41cHQiPiZuYnNwOzwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkluIG15IG9waW5pb24gaXTigJlz IGJldHRlciB0byBmb2xsb3cgdGhlIHN0YW5kYXJkLiBBbmQsIGFnYWluLCBBcHBlbmRpeCBGIGRl c2NyaWJlcyBob3cgdG8gbm90IGluY2x1ZGVkIHRoZSBjbGFpbXMgaW4gYSBzdGFuZGFyZCB3YXku PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkFsc28sIEkgYW0gbm90IHN1cmUgKG5lZWQgdG8gdmVy aWZ5KSB3aGV0aGVyIGl04oCZcyBhbGxvd2VkIHRvIHJlbW92ZSBhbGwgaGVhZGVycy48bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+QWxzbywgKjxiPklGPC9iPiogd2Ugd2FudCB0byB1c2UgdGhlIOKA nGNhbm9u4oCdIGhlYWRlciBmaWVsZCBwYXJhbWV0ZXIsIHRoZSBkcmFmdCBkb2VzbuKAmXQgZ2l2 ZSBlbm91Z2ggaW5mb3JtYXRpb24gb24gaG93IGl0IGlzIGdlbmVyYXRlZC48bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+V2UgaGF2ZSB0aGUgZm9sbG93aW5nIHN5bnRheCBpbiBTZWN0aW9uIDg6PG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJ0ZXh0LWluZGVudDozNi4wcHQiPmNhbm9uaWNh bC1zdHIgPSAmcXVvdDtjYW5vbiZxdW90OyBFUVVBTCAqYmFzZTY0LWNoYXI8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+4oCmYW5kLCBpbiBhIGZldyBwbGFjZXMgb2YgdGhlIGRvY3VtZW50IHdlIGhh dmUgdGV4dCBsaWtlOjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7 PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0idGV4dC1pbmRlbnQ6 MzYuMHB0Ij7igJxUaGUgc3ludGF4IG9mICZxdW90O2Nhbm9uJnF1b3Q7IGlzIGdpdmVuIGluIFNl Y3Rpb24gODsgZXNzZW50aWFsbHksIGl0IGNvbnRhaW5zIGEgYmFzZTY0PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsmbmJzcDsgJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IGVuY29kaW5nIG9mIHRoZSBK U09OIGhlYWRlciBhbmQgY2xhaW1zIGluIHRoZSBQQVNTcG9yVCBvYmplY3Qu4oCdPG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPkJ1dCwgSSBjYW5ub3QgZmluZCB0ZXh0IG9uIGhvdyB0aGF0IGJhc2U2 NC1jaGFyIHN0cmluZyBpcyBnZW5lcmF0ZWQuIFlvdSBoYXZlIHRoZSBiYXNlNjQgZW5jb2Rpbmcg b2YgdGhlIEpTT04gaGVhZGVyLCBhbmQgdGhlIGJhc2U2NCBlbmNvZGluZyBvZiB0aGUgY2xhaW1z LiBIb3cgZG8geW91IGNvbWJpbmUgdGhlbSBpbnRvIHRoZSBiYXNlNjQgZW5jb2RlZCDigJxjYW5v buKAnSB2YWx1ZT88bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+UmVnYXJkcyw8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+Q2hyaXN0ZXI8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVO LVVTIiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtmb250LWZhbWlseTomcXVvdDtUaW1lcyBOZXcg Um9tYW4mcXVvdDssc2VyaWYiPl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fIHN0aXIgbWFpbGluZyBsaXN0DQo8YSBocmVmPSJtYWlsdG86c3RpckBpZXRmLm9y ZyI+c3RpckBpZXRmLm9yZzwvYT4gPGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1h bi9saXN0aW5mby9zdGlyIj4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8v c3RpcjwvYT4gPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+ DQo= --_000_7594FB04B1934943A5C02806D1A2204B476BD10CESESSMB209erics_-- From nobody Sat Jul 16 16:40:07 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 72AC812D098 for ; Sat, 16 Jul 2016 16:40:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.6 X-Spam-Level: X-Spam-Status: No, score=-102.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1d4-XpKbkRSG for ; Sat, 16 Jul 2016 16:40:02 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0a-0018ba01.pphosted.com [67.231.149.94]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DB8DD12D0F1 for ; Sat, 16 Jul 2016 16:40:02 -0700 (PDT) Received: from pps.filterd (m0078666.ppops.net [127.0.0.1]) by mx0a-0018ba01.pphosted.com (8.16.0.17/8.16.0.17) with SMTP id u6GNWSTr013920; Sat, 16 Jul 2016 19:39:59 -0400 Received: from stntexhc12.cis.neustar.com ([156.154.17.216]) by mx0a-0018ba01.pphosted.com with ESMTP id 247h1nrvbg-1 (version=TLSv1 cipher=AES128-SHA bits=128 verify=NOT); Sat, 16 Jul 2016 19:39:59 -0400 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.94]) by stntexhc12.cis.neustar.com ([::1]) with mapi id 14.03.0279.002; Sat, 16 Jul 2016 19:39:57 -0400 From: "Peterson, Jon" To: Christer Holmberg Thread-Topic: [stir] Separation of JWS Thread-Index: AQHR3imlxQWCiaKHYkOkgu/OqfssD6AZMS/wgABGHqGAACXa4IABg0UAgACfpgD///pSDA== Date: Sat, 16 Jul 2016 23:39:56 +0000 Message-ID: References: <7594FB04B1934943A5C02806D1A2204B476AB520@ESESSMB208.ericsson.se> <7B90D2FC-7142-4801-B84E-FB459A2339C9@neustar.biz> <7594FB04B1934943A5C02806D1A2204B476ABFD3@ESESSMB208.ericsson.se> , <7594FB04B1934943A5C02806D1A2204B476BD10C@ESESSMB209.ericsson.se> In-Reply-To: <7594FB04B1934943A5C02806D1A2204B476BD10C@ESESSMB209.ericsson.se> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: multipart/alternative; boundary="_000_CBC570D0F04848D792504B16C072619Cneustarbiz_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-07-16_17:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1607160292 Archived-At: Cc: IETF STIR Mail List , Richard Shockey Subject: Re: [stir] Separation of JWS X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 16 Jul 2016 23:40:05 -0000 --_000_CBC570D0F04848D792504B16C072619Cneustarbiz_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable I asked some people about this at the IETF today, but I'm still not clear (= and I am not sure RFC7515 is clear) if the intention of Appendix F is to om= it both the headers and claims or just the claims. I'll continue asking aro= und about it - the ambiguity is about what the "payload" there means exactl= y. I will say though that 4474bis is being implemented by a number of people a= t this point and I haven't heard this particular problem raised before. I d= on't think it is unclear what you're supposed to do with "canon". We can ar= gue what is most optimal, but I hesitate to make yet another syntax change = for the sake of something that doesn't really change the semantics. The spe= c doesn't need to be further delayed for purely cosmetic reasons. Frustratingly, I suspect that this is just a question of syntax, and that a= t the end of the day it sounds like we're trying to get to the same place. = Sometimes it is hardest to choose between options when the differences are = the slightest. Jon Peterson Neustar, Inc. Sent from my iPad On Jul 16, 2016, at 10:00 PM, Christer Holmberg > wrote: Hi, I am commenting with an implementer hat on, and I don=92t think we should a= ccept what we have now. In my opinion there would be interop issues from da= y one, because 1) we are =93splitting=94 the encoded JWS string into differ= ent pieces, and 2) it is not clear how the encoding of that will look like. My suggestion is to send the whole encoded PassPORT JWS object string as th= e Identity header field value, according to the JWS standard, and drop the = =93canon=94 header field parameter. That was my assumption since the day we= adopted JWS. I still allows not sending the claims in a standard manner. I= also don=92t think it should be allowed to drop the mandatory JWS headers. Doing the change in the draft should not be a big task. Regards, Christer From: Richard Shockey [mailto:richard@shockey.us] Sent: 16 July 2016 13:29 To: Christer Holmberg >; Peterson, Jon > Cc: IETF STIR Mail List > Subject: Re: [stir] Separation of JWS Christer if you are frustrated I certainly understand. As I have read through v10 here I=92m wondering how it can be successfully = implemented by the vendor community. There is clearly strong, in fact over= whelming demand to implement this but the last thing we need are the kinds = of baked in interoperability problems we have seen in VoLTE, for instance. = I can assure you the NRA=92s have been told we have a solution but we real= istically need to give them some implementation timelines. The lack of actual full examples of a typical originating INVITE, is appall= ing. I have serious questions whether this document is ready for adoption. Should we just accept what we have now? Should the SIP Forum immediately l= ook into some ongoing profile work here as we start down this road? I kno= w Robert would like to see some examples of implementations at SIPit but is= there enough time given the ongoing questions the document does not answer= . =97 Richard Shockey Shockey Consulting LLC Chairman of the Board SIP Forum www.shockey.us www.sipforum.org richardshockey.us Skype-Linkedin-Facebook rshockey101 PSTN +1 703-593-2683 From: stir > on behalf = of Christer Holmberg > Date: Friday, July 15, 2016 at 5:35 PM To: "Peterson, Jon" > Cc: IETF STIR Mail List > Subject: Re: [stir] Separation of JWS Hi, >Oh, you meant Appendix F of RFC7515. I had thought you said RFC7315 in you= r other mail, so perhaps you can understand my confusion. Sorry :) >My reading of that is that it can remove the claims but not the header. Bu= t it's also not super specific about how it works. What do you think is unclear? I am using it for a draft I=92m working on, and I think it=92s pretty clear= :) I am also not sure why we should remove the headers. Don=92t we need that i= nformation? >5.2.1 of rfc4474bis-10 contains the crispest statement of the syntax of ca= non, perhaps, but it is not the job of rfc4474bis to repeat the guidance of >PASSporT on how to construct the object. Perhaps a pointer to that specifi= c section of PASSporT would help? My question is not how to construct the object, but how to construct the = =93canon=94 header field value, which seems to be only a part of the object= string. Section 5.2.1 describes which components (headers and claims) are used to c= reate the =93canon=94 value, but now HOW it=92s created. So, I=92d like to suggest that we transport the PASSportT object string as = the Identity header field value, and don=92t use =93canon=94. I am happy to= hear why we can=92t do that, but so far I have not heard/read anything :) That would also allow people to use off-the-shelf JWS encoders/decoders, an= d we would avoid the confusion of transporting different parts of the objec= t string in different places. Regards, Christer On Jul 15, 2016, at 2:09 AM, Christer Holmberg > wrote: Hi, > This is partly the same question as we are exploring in the "syntax chang= e" thread discussion on whether or not "canon" will always be included. It=92s not really the same. My question is: *IF* the claims are included, w= hy do we put them in a separate place (the =93canon=94 header field paramet= er)? Why don=92t we use the standard JWS mechanism? >To answer your question, think about it as if SIP does not carry a JWS obj= ect, but instead it transports some data that allows a verification service >to generate a JWS object. So we're not "sending" the JWS object, and thus = we're under no obligation to "send it as one string" or whatever. > >The rfc4474bis "canon" parameter optionally contains the encoded portion o= f the header and claims of the JWS object because the headers (and claims) = in baseline PASSporT are usually redundant wth the contents of >a SIP reque= st - we anticipate that any verification service can ordinarily regenerate = those headers and claims itself, so, there's no ostensible value in carryin= g them. Generally speaking, we should bloating messages >with redundant fie= lds if we can. I agree. But, Appendix F describes how to do that with JWS. >If you're asking why we chose to demarcate that with "canon" rather than j= ust not including the JWS header and claims if we didn't >want to include the JWS header and claims, it is generally better to be ex= plicit than to leave the verification service to infer what is going. In my opinion it=92s better to follow the standard. And, again, Appendix F = describes how to not included the claims in a standard way. Also, I am not sure (need to verify) whether it=92s allowed to remove all h= eaders. Also, *IF* we want to use the =93canon=94 header field parameter, the draft= doesn=92t give enough information on how it is generated. We have the following syntax in Section 8: canonical-str =3D "canon" EQUAL *base64-char =85and, in a few places of the document we have text like: =93The syntax of "canon" is given in Section 8; essentially, it contains a = base64 encoding of the JSON header and claims in the PASSporT object= .=94 But, I cannot find text on how that base64-char string is generated. You ha= ve the base64 encoding of the JSON header, and the base64 encoding of the c= laims. How do you combine them into the base64 encoded =93canon=94 value? Regards, Christer _______________________________________________ stir mailing list stir@ietf= .org https://www.ietf.org/mailman/listinfo/stir --_000_CBC570D0F04848D792504B16C072619Cneustarbiz_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable
I asked some people about this at the IETF today, but I'm still not cl= ear (and I am not sure RFC7515 is clear) if the intention of Appendix F is = to omit both the headers and claims or just the claims. I'll continue askin= g around about it - the ambiguity is about what the "payload" there means exactly. 

I will say though that 4474bis is being impl= emented by a number of people at this point and I haven't heard this partic= ular problem raised before. I don't think it is unclear what you're suppose= d to do with "canon". We can argue what is most optimal, but I hesitate to make yet another syntax change for= the sake of something that doesn't really change the semantics. The spec d= oesn't need to be further delayed for purely cosmetic reasons.

Frustratingly, I suspect that this is just a= question of syntax, and that at the end of the day it sounds like we're tr= ying to get to the same place. Sometimes it is hardest to choose between op= tions when the differences are the slightest. 

Jon Peterson
Neustar, Inc.

Sent from my iPad

On Jul 16, 2016, at 10:00 PM, Christer Holmberg <christer.holmberg@ericsson.com> wrote:

Hi,

 

I am commenting with an implementer hat on, and I don=92t think we sho= uld accept what we have now. In my opinion there would be interop issues fr= om day one, because 1) we are =93splitting=94 the encoded JWS string into different pieces, and 2) it is not clear how t= he encoding of that will look like.

 

My suggestion is to send the whole encoded PassPORT JWS object string = as the Identity header field value, according to the JWS standard, and drop= the =93canon=94 header field parameter. That was my assumption since the day we adopted JWS. I still allows not se= nding the claims in a standard manner. I also don=92t think it should be al= lowed to drop the mandatory JWS headers.

 

Doing the change in the draft should not be a big task.

 

Regards,

 

Christer

 

 

 

From: Richard Shockey [mailto:r= ichard@shockey.us]
Sent: 16 July 2016 13:29
To: Christer Holmberg <christer.holmberg@ericsson.com>; Peterson, Jon <jon.peterson@neustar.biz>
Cc: IETF STIR Mail List <stir@ie= tf.org>
Subject: Re: [stir] Separation of JWS

 

 

Christer if you are frustrated = I certainly understand.  

 

As I have read through v10 here= I=92m wondering how it can be successfully implemented by the vendor commu= nity.  There is clearly strong, in fact overwhelming demand to impleme= nt this but the last thing we need are the kinds of baked in interoperability problems we have seen in VoLTE, for ins= tance.  I can assure you the NRA=92s have been told we have a solution= but we realistically need to give them some implementation timelines.

 

The lack of actual full example= s of a typical originating INVITE, is appalling.  I have serious quest= ions whether this document is ready for adoption. 

 

Should we just accept what we h= ave now?  Should the SIP Forum immediately look into some ongoing prof= ile work here as we start down this road?   I know Robert would l= ike to see some examples of implementations at SIPit but is there enough time given the ongoing questions the document does not= answer.

 

 

 

=97 

Richard Shockey

Shockey Consulting LLC

Chairman of the Board SIP Forum

richard<at>shockey.us<= /o:p>

Skype-Linkedin-Facebook rshockey101

PSTN +1 703-593-2683

 

 

From: = stir <stir-bounces@ietf.org> on behalf of Chr= ister Holmberg <christ= er.holmberg@ericsson.com>
Date: Friday, July 15, 2016 at 5:35 PM
To: "Peterson, Jon" <jon.peterson@neustar.biz>
Cc: IETF STIR Mail List <stir@ie= tf.org>
Subject: Re: [stir] Separation of JWS

 

Hi,<= /p>

 

>Oh, you meant Appendix F of RFC7515. I had thoug= ht you said RFC7315 in your other mail, so perhaps you can understand my co= nfusion.  

 

Sorry :)

 

>My reading of that is that it can remove the cla= ims but not the header. But it's also not super specific about how it works= . 

 

What do you think is unclear?

 

I am using it for a draft I=92m working on, and I th= ink it=92s pretty clear :)

 

I am also not sure why we should remove the headers.= Don=92t we need that information?

 

>5.2.1 of rfc4474bis-10 contains the crispest sta= tement of the syntax of canon, perhaps, but it is not the job of rfc4474bis= to repeat the guidance of

>PASSporT on how to construct the object. Perhaps= a pointer to that specific section of PASSporT would help?

 

My question is not how to construct the object, but = how to construct the =93canon=94 header field value, which seems to be only= a part of the object string.

 

Section 5.2.1 describes which components (headers an= d claims) are used to create the =93canon=94 value, but now HOW it=92s crea= ted.

 

So, I=92d like to suggest that we transport the PASS= portT object string as the Identity header field value, and don=92t use =93= canon=94. I am happy to hear why we can=92t do that, but so far I have not = heard/read anything :)

 

That would also allow people to use off-the-shelf JW= S encoders/decoders, and we would avoid the confusion of transporting diffe= rent parts of the object string in different places.

 

Regards,

 

Christer

 


On Jul 15, 2016, at 2:09 AM, Christer Holmberg <christer.holmberg@ericsson.com> wrote:

Hi,<= /p>

 <= /span>

> This is partly the same question as we are exploring in the &= quot;syntax change" thread discussion on whether or not "canon&qu= ot; will always be included.

 

It=92s not really the same. My question is: *IF* the claims are included, why do we put them in a separate place (the = =93canon=94 header field parameter)? Why don=92t we use the standard JWS me= chanism?

 <= /span>

>To answer your question, think about it as if SIP does not car= ry a JWS object, but instead it transports some data that allows a verifica= tion service

>to = generate a JWS object. So we're not "sending" the JWS object, and= thus we're under no obligation to "send it as one string" or wha= tever.

> 

>The rfc4474bis "canon" parameter optionally contains= the encoded portion of the header and claims of the JWS object because the= headers (and claims) in baseline PASSporT are usually redundant wth the contents of >a SIP= request - we anticipate that any verification service can ordinarily regen= erate those headers and claims itself, so, there's no ostensible value in c= arrying them. Generally speaking, we should bloating messages >with redun= dant fields if we can. 

 <= /o:p>

I agree. But, Appendix F describes how to do that wi= th JWS.

 

>If you're asking why we chose to demarcate that with "can= on" rather than just not including the JWS header and claims if we did= n't

>wan= t to include the JWS header and claims, it is generally better to be explic= it than to leave the verification service to infer what is going.

 <= /o:p>

In my opinion it=92s better to follow the standard. = And, again, Appendix F describes how to not included the claims in a standa= rd way.

 

Also, I am not sure (need to verify) whether it=92s = allowed to remove all headers.

 

Also, *IF* we want to use the =93canon=94 hea= der field parameter, the draft doesn=92t give enough information on how it = is generated.

 

We have the following syntax in Section 8:

 

canonical-str =3D "= ;canon" EQUAL *base64-char

 

=85and, in a few places of the document we have text= like:

 

=93The syntax of "= canon" is given in Section 8; essentially, it contains a base64

         &nb= sp;    encoding of the JSON header and claims in the PASSpor= T object.=94

 

But, I cannot find text on how that base64-char stri= ng is generated. You have the base64 encoding of the JSON header, and the b= ase64 encoding of the claims. How do you combine them into the base64 encod= ed =93canon=94 value?

 

Regards,

 

Christer

 

_________________________________= ______________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir

--_000_CBC570D0F04848D792504B16C072619Cneustarbiz_-- From nobody Sun Jul 17 02:51:32 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 893AE12D579 for ; Sun, 17 Jul 2016 02:51:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.83 X-Spam-Level: X-Spam-Status: No, score=-1.83 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_SORBS_WEB=0.77] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=chriswendt-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 77QLXp2YYqmn for ; Sun, 17 Jul 2016 02:51:28 -0700 (PDT) Received: from mail-wm0-x236.google.com (mail-wm0-x236.google.com [IPv6:2a00:1450:400c:c09::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CA71012D507 for ; Sun, 17 Jul 2016 02:51:27 -0700 (PDT) Received: by mail-wm0-x236.google.com with SMTP id f65so71983709wmi.0 for ; Sun, 17 Jul 2016 02:51:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chriswendt-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=gaxmXsxDUi95x6bS8SEAtOugzHEd+TefEN7rGnH/NQk=; b=SLnk1DG4HFuHkDyXjrw5WeaNA+s6Dt3i8nmu9l5bHVX+Fl3kv9jity4Vq/+fMhO/F7 y+hsUaxy06srIes3OdWunNhidZlSG9flaa+N1BPXdB4tN+e09dqU/04cucwFbkSyBDh5 1SD9POzvGevjjjbX+B0fwgJ0Y6ExvwxgFajGReR73GffiJdthfe7jC9hqi1MSyeTXMyn 4aZM6IPh8qIGbostkYsJBNseItzggYw2TRnOl5S1KWAbUh6BZrBo2bfuiHbR3lQJqxai Hsq87PpNEHQ8VYV05rTb9+Bph1izsFm8OM56wzsBPXNR5vvFJginBxOwCDtmCzSYKVIe SKNA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=gaxmXsxDUi95x6bS8SEAtOugzHEd+TefEN7rGnH/NQk=; b=XXwDSRobwFQ9y9H5WERpFQnjeVcAtmgxnUTYt7UDlZrFqZfOYhKZ57ymKSYbw4NFEo ugbK0S7/w4CnPjPVLwjSBZ9KavrfhpBh0vwHD/Au5XpZ8Z6+hu8mTb2OTjsqXIsFyL76 hwStrNnJRuM9ozTpr28HMjWYJHghnHmTKU5ZhoPvXsvdJZNFKvoULeXPV7jF769DJWG/ 5omTwVljvCJ3PM2N5sbGiICnzUEb1dKxI3WJRrRP7Mj8sxLM7t87eWZDHcbA2MBhHHtt VlT2g4A6V/kQh0sHf4tNk/ix4IBj4jxt2MlZnbjQ5DGulHq122EISz5/XeVNSAsl9Zfg NCew== X-Gm-Message-State: ALyK8tKaZ2Cz6CJFq0RVIGsJ5kqiVj6FSbAFAyYh+Q5wAk9UcmtEJU/QvsojXuQz3Sxf6A== X-Received: by 10.28.26.5 with SMTP id a5mr24305612wma.27.1468749086314; Sun, 17 Jul 2016 02:51:26 -0700 (PDT) Received: from [172.20.0.17] ([62.217.47.18]) by smtp.gmail.com with ESMTPSA id q139sm6781046wmb.18.2016.07.17.02.51.24 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sun, 17 Jul 2016 02:51:25 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Chris Wendt In-Reply-To: Date: Sun, 17 Jul 2016 05:51:30 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: <69E003F9-54BD-4525-830D-FB728E33423B@chriswendt.net> References: <3A38E008-748D-450A-8A58-A08EF4C972C8@att.com> To: Sean Turner X-Mailer: Apple Mail (2.3124) Archived-At: Cc: stir@ietf.org Subject: Re: [stir] Consensus Call Regarding Early Codepoint Allocation X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 17 Jul 2016 09:51:30 -0000 +1 > On Jul 14, 2016, at 5:44 PM, Sean Turner wrote: >=20 > I do as well, but then again I requested them so I=E2=80=99m a little = biased. >=20 > spt >=20 >> On Jul 13, 2016, at 15:25, DOLLY, MARTIN C wrote: >>=20 >> I support early code point allocation >>=20 >> Regards >>=20 >> Martin C Dolly >> Lead Member of Technical Staff >> Core & Government/Regulatory Standards=20 >> AT&T >> Cell: 609-903-3360 >> Email: md3135@att.com >>=20 >>> On Jul 13, 2016, at 3:20 PM, Russ Housley = wrote: >>>=20 >>> The STIR Certificates document (draft-ietf-stir-certificates-07.txt) >>> calls for IANA to allocation four codepoints: >>>=20 >>> o TN Certificate Extension in the SMI Security for PKIX Certificate >>> Extension registry: http://www.iana.org/assignments/smi-numbers/ >>> smi-numbers.xhtml#smi-numbers-1.3.6.1.5.5.7.1 >>>=20 >>> o TN-HVE OCSP extension in the SMI Security for PKIX Online >>> Certificate Status Protocol (OCSP) registry: >>> = http://www.iana.org/assignments/smi-numbers/smi-numbers.xhtml#smi- >>> numbers-1.3.6.1.5.5.7.48.1 >>>=20 >>> o TNS by reference access descriptor in the SMI Security for PKIX >>> Access Descriptor registry: http://www.iana.org/assignments/smi- >>> numbers/smi-numbers.xhtml#smi-numbers-1.3.6.1.5.5.7.48 >>>=20 >>> o The TN ASN.1 module in SMI Security for PKIX Module Identifier >>> registry: http://www.iana.org/assignments/smi-numbers/smi- >>> numbers.xhtml#smi-numbers-1.3.6.1.5.5.7.0=20 >>>=20 >>> The document authors have requested that IANA perform an early >>> allocation of these codepoints. Consensus of the STIR WG is needed >>> for the IESG to request early allocation. >>>=20 >>> Please let us know whether you support early codepoint allocation. >>>=20 >>> Thanks, >>> Russ >>>=20 >>> _______________________________________________ >>> stir mailing list >>> stir@ietf.org >>> https://www.ietf.org/mailman/listinfo/stir >>=20 >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir From nobody Sun Jul 17 04:14:36 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 051B512D54B for ; Sun, 17 Jul 2016 04:14:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.619 X-Spam-Level: X-Spam-Status: No, score=-2.619 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ejwtEQv9-ST3 for ; Sun, 17 Jul 2016 04:14:31 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0b-00191d01.pphosted.com [67.231.157.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D3C3712D1AC for ; Sun, 17 Jul 2016 04:14:30 -0700 (PDT) Received: from pps.filterd (m0049462.ppops.net [127.0.0.1]) by m0049462.ppops.net-00191d01. (8.16.0.11/8.16.0.11) with SMTP id u6HBDPfX024737; Sun, 17 Jul 2016 07:14:27 -0400 Received: from alpi155.enaf.aldc.att.com (sbcsmtp7.sbc.com [144.160.229.24]) by m0049462.ppops.net-00191d01. with ESMTP id 2481v744n2-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sun, 17 Jul 2016 07:14:27 -0400 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id u6HBEQpf023036; Sun, 17 Jul 2016 07:14:27 -0400 Received: from mlpi408.sfdc.sbc.com (mlpi408.sfdc.sbc.com [130.9.128.240]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id u6HBEMOS023013 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Sun, 17 Jul 2016 07:14:23 -0400 Received: from MISOUT7MSGHUBAF.ITServices.sbc.com (MISOUT7MSGHUBAF.itservices.sbc.com [130.9.129.150]) by mlpi408.sfdc.sbc.com (RSA Interceptor); Sun, 17 Jul 2016 11:14:02 GMT Received: from MISOUT7MSGUSRDB.ITServices.sbc.com ([169.254.2.245]) by MISOUT7MSGHUBAF.ITServices.sbc.com ([130.9.129.150]) with mapi id 14.03.0294.000; Sun, 17 Jul 2016 07:14:01 -0400 From: "DOLLY, MARTIN C" To: Christer Holmberg , Richard Shockey , "Peterson, Jon" Thread-Topic: [stir] Separation of JWS Thread-Index: AQHR3imlxQWCiaKHYkOkgu/OqfssD6AZMS/wgABGHqGAACXa4IABg0UAgACfpgCAALt9YA== Date: Sun, 17 Jul 2016 11:14:00 +0000 Message-ID: References: <7594FB04B1934943A5C02806D1A2204B476AB520@ESESSMB208.ericsson.se> <7B90D2FC-7142-4801-B84E-FB459A2339C9@neustar.biz> <7594FB04B1934943A5C02806D1A2204B476ABFD3@ESESSMB208.ericsson.se> <7594FB04B1934943A5C02806D1A2204B476BD10C@ESESSMB209.ericsson.se> In-Reply-To: <7594FB04B1934943A5C02806D1A2204B476BD10C@ESESSMB209.ericsson.se> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [130.10.250.52] Content-Type: multipart/alternative; boundary="_000_E42CCDDA6722744CB241677169E836563F594E2BMISOUT7MSGUSRDB_" MIME-Version: 1.0 X-RSA-Inspected: yes X-RSA-Classifications: public X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-07-17_08:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1607170141 Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] Separation of JWS X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 17 Jul 2016 11:14:34 -0000 --_000_E42CCDDA6722744CB241677169E836563F594E2BMISOUT7MSGUSRDB_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Q29uY2VybmluZyB0aGF0IG9uZSBvZiBvdXIgbGFyZ2VzdCB2ZW5kb3IgaGFzIGludGVyb3BlcmFi aWxpdHkgY29uY2VybnMNCg0KSSB0cnVzdCBDaHJpc3RlciB3aGVuIGhlIHNheXMgdGhlIGNoYW5n ZSBzaG91bGQgbm90IGJlIGEgYmlnIHRhc2ssIHNvIHBsZWFzZSBtYWtlIGl0Lg0KDQpGcm9tOiBz dGlyIFttYWlsdG86c3Rpci1ib3VuY2VzQGlldGYub3JnXSBPbiBCZWhhbGYgT2YgQ2hyaXN0ZXIg SG9sbWJlcmcNClNlbnQ6IFNhdHVyZGF5LCBKdWx5IDE2LCAyMDE2IDQ6MDAgUE0NClRvOiBSaWNo YXJkIFNob2NrZXkgPHJpY2hhcmRAc2hvY2tleS51cz47IFBldGVyc29uLCBKb24gPGpvbi5wZXRl cnNvbkBuZXVzdGFyLmJpej4NCkNjOiBJRVRGIFNUSVIgTWFpbCBMaXN0IDxzdGlyQGlldGYub3Jn Pg0KU3ViamVjdDogUmU6IFtzdGlyXSBTZXBhcmF0aW9uIG9mIEpXUw0KDQpIaSwNCg0KSSBhbSBj b21tZW50aW5nIHdpdGggYW4gaW1wbGVtZW50ZXIgaGF0IG9uLCBhbmQgSSBkb27igJl0IHRoaW5r IHdlIHNob3VsZCBhY2NlcHQgd2hhdCB3ZSBoYXZlIG5vdy4gSW4gbXkgb3BpbmlvbiB0aGVyZSB3 b3VsZCBiZSBpbnRlcm9wIGlzc3VlcyBmcm9tIGRheSBvbmUsIGJlY2F1c2UgMSkgd2UgYXJlIOKA nHNwbGl0dGluZ+KAnSB0aGUgZW5jb2RlZCBKV1Mgc3RyaW5nIGludG8gZGlmZmVyZW50IHBpZWNl cywgYW5kIDIpIGl0IGlzIG5vdCBjbGVhciBob3cgdGhlIGVuY29kaW5nIG9mIHRoYXQgd2lsbCBs b29rIGxpa2UuDQoNCk15IHN1Z2dlc3Rpb24gaXMgdG8gc2VuZCB0aGUgd2hvbGUgZW5jb2RlZCBQ YXNzUE9SVCBKV1Mgb2JqZWN0IHN0cmluZyBhcyB0aGUgSWRlbnRpdHkgaGVhZGVyIGZpZWxkIHZh bHVlLCBhY2NvcmRpbmcgdG8gdGhlIEpXUyBzdGFuZGFyZCwgYW5kIGRyb3AgdGhlIOKAnGNhbm9u 4oCdIGhlYWRlciBmaWVsZCBwYXJhbWV0ZXIuIFRoYXQgd2FzIG15IGFzc3VtcHRpb24gc2luY2Ug dGhlIGRheSB3ZSBhZG9wdGVkIEpXUy4gSSBzdGlsbCBhbGxvd3Mgbm90IHNlbmRpbmcgdGhlIGNs YWltcyBpbiBhIHN0YW5kYXJkIG1hbm5lci4gSSBhbHNvIGRvbuKAmXQgdGhpbmsgaXQgc2hvdWxk IGJlIGFsbG93ZWQgdG8gZHJvcCB0aGUgbWFuZGF0b3J5IEpXUyBoZWFkZXJzLg0KDQpEb2luZyB0 aGUgY2hhbmdlIGluIHRoZSBkcmFmdCBzaG91bGQgbm90IGJlIGEgYmlnIHRhc2suDQoNClJlZ2Fy ZHMsDQoNCkNocmlzdGVyDQoNCg0KDQoNCkZyb206IFJpY2hhcmQgU2hvY2tleSBbbWFpbHRvOnJp Y2hhcmRAc2hvY2tleS51c10NClNlbnQ6IDE2IEp1bHkgMjAxNiAxMzoyOQ0KVG86IENocmlzdGVy IEhvbG1iZXJnIDxjaHJpc3Rlci5ob2xtYmVyZ0Blcmljc3Nvbi5jb208bWFpbHRvOmNocmlzdGVy LmhvbG1iZXJnQGVyaWNzc29uLmNvbT4+OyBQZXRlcnNvbiwgSm9uIDxqb24ucGV0ZXJzb25AbmV1 c3Rhci5iaXo8bWFpbHRvOmpvbi5wZXRlcnNvbkBuZXVzdGFyLmJpej4+DQpDYzogSUVURiBTVElS IE1haWwgTGlzdCA8c3RpckBpZXRmLm9yZzxtYWlsdG86c3RpckBpZXRmLm9yZz4+DQpTdWJqZWN0 OiBSZTogW3N0aXJdIFNlcGFyYXRpb24gb2YgSldTDQoNCg0KQ2hyaXN0ZXIgaWYgeW91IGFyZSBm cnVzdHJhdGVkIEkgY2VydGFpbmx5IHVuZGVyc3RhbmQuDQoNCkFzIEkgaGF2ZSByZWFkIHRocm91 Z2ggdjEwIGhlcmUgSeKAmW0gd29uZGVyaW5nIGhvdyBpdCBjYW4gYmUgc3VjY2Vzc2Z1bGx5IGlt cGxlbWVudGVkIGJ5IHRoZSB2ZW5kb3IgY29tbXVuaXR5LiAgVGhlcmUgaXMgY2xlYXJseSBzdHJv bmcsIGluIGZhY3Qgb3ZlcndoZWxtaW5nIGRlbWFuZCB0byBpbXBsZW1lbnQgdGhpcyBidXQgdGhl IGxhc3QgdGhpbmcgd2UgbmVlZCBhcmUgdGhlIGtpbmRzIG9mIGJha2VkIGluIGludGVyb3BlcmFi aWxpdHkgcHJvYmxlbXMgd2UgaGF2ZSBzZWVuIGluIFZvTFRFLCBmb3IgaW5zdGFuY2UuICBJIGNh biBhc3N1cmUgeW91IHRoZSBOUkHigJlzIGhhdmUgYmVlbiB0b2xkIHdlIGhhdmUgYSBzb2x1dGlv biBidXQgd2UgcmVhbGlzdGljYWxseSBuZWVkIHRvIGdpdmUgdGhlbSBzb21lIGltcGxlbWVudGF0 aW9uIHRpbWVsaW5lcy4NCg0KVGhlIGxhY2sgb2YgYWN0dWFsIGZ1bGwgZXhhbXBsZXMgb2YgYSB0 eXBpY2FsIG9yaWdpbmF0aW5nIElOVklURSwgaXMgYXBwYWxsaW5nLiAgSSBoYXZlIHNlcmlvdXMg cXVlc3Rpb25zIHdoZXRoZXIgdGhpcyBkb2N1bWVudCBpcyByZWFkeSBmb3IgYWRvcHRpb24uDQoN ClNob3VsZCB3ZSBqdXN0IGFjY2VwdCB3aGF0IHdlIGhhdmUgbm93PyAgU2hvdWxkIHRoZSBTSVAg Rm9ydW0gaW1tZWRpYXRlbHkgbG9vayBpbnRvIHNvbWUgb25nb2luZyBwcm9maWxlIHdvcmsgaGVy ZSBhcyB3ZSBzdGFydCBkb3duIHRoaXMgcm9hZD8gICBJIGtub3cgUm9iZXJ0IHdvdWxkIGxpa2Ug dG8gc2VlIHNvbWUgZXhhbXBsZXMgb2YgaW1wbGVtZW50YXRpb25zIGF0IFNJUGl0IGJ1dCBpcyB0 aGVyZSBlbm91Z2ggdGltZSBnaXZlbiB0aGUgb25nb2luZyBxdWVzdGlvbnMgdGhlIGRvY3VtZW50 IGRvZXMgbm90IGFuc3dlci4NCg0KDQoNCuKAlA0KUmljaGFyZCBTaG9ja2V5DQpTaG9ja2V5IENv bnN1bHRpbmcgTExDDQpDaGFpcm1hbiBvZiB0aGUgQm9hcmQgU0lQIEZvcnVtDQp3d3cuc2hvY2tl eS51czxodHRwOi8vd3d3LnNob2NrZXkudXM+DQp3d3cuc2lwZm9ydW0ub3JnPGh0dHA6Ly93d3cu c2lwZm9ydW0ub3JnPg0KcmljaGFyZDxhdD5zaG9ja2V5LnVzDQpTa3lwZS1MaW5rZWRpbi1GYWNl Ym9vayByc2hvY2tleTEwMQ0KUFNUTiArMSA3MDMtNTkzLTI2ODMNCg0KDQpGcm9tOiBzdGlyIDxz dGlyLWJvdW5jZXNAaWV0Zi5vcmc8bWFpbHRvOnN0aXItYm91bmNlc0BpZXRmLm9yZz4+IG9uIGJl aGFsZiBvZiBDaHJpc3RlciBIb2xtYmVyZyA8Y2hyaXN0ZXIuaG9sbWJlcmdAZXJpY3Nzb24uY29t PG1haWx0bzpjaHJpc3Rlci5ob2xtYmVyZ0Blcmljc3Nvbi5jb20+Pg0KRGF0ZTogRnJpZGF5LCBK dWx5IDE1LCAyMDE2IGF0IDU6MzUgUE0NClRvOiAiUGV0ZXJzb24sIEpvbiIgPGpvbi5wZXRlcnNv bkBuZXVzdGFyLmJpejxtYWlsdG86am9uLnBldGVyc29uQG5ldXN0YXIuYml6Pj4NCkNjOiBJRVRG IFNUSVIgTWFpbCBMaXN0IDxzdGlyQGlldGYub3JnPG1haWx0bzpzdGlyQGlldGYub3JnPj4NClN1 YmplY3Q6IFJlOiBbc3Rpcl0gU2VwYXJhdGlvbiBvZiBKV1MNCg0KSGksDQoNCj5PaCwgeW91IG1l YW50IEFwcGVuZGl4IEYgb2YgUkZDNzUxNS4gSSBoYWQgdGhvdWdodCB5b3Ugc2FpZCBSRkM3MzE1 IGluIHlvdXIgb3RoZXIgbWFpbCwgc28gcGVyaGFwcyB5b3UgY2FuIHVuZGVyc3RhbmQgbXkgY29u ZnVzaW9uLg0KDQpTb3JyeSA6KQ0KDQo+TXkgcmVhZGluZyBvZiB0aGF0IGlzIHRoYXQgaXQgY2Fu IHJlbW92ZSB0aGUgY2xhaW1zIGJ1dCBub3QgdGhlIGhlYWRlci4gQnV0IGl0J3MgYWxzbyBub3Qg c3VwZXIgc3BlY2lmaWMgYWJvdXQgaG93IGl0IHdvcmtzLg0KDQpXaGF0IGRvIHlvdSB0aGluayBp cyB1bmNsZWFyPw0KDQpJIGFtIHVzaW5nIGl0IGZvciBhIGRyYWZ0IEnigJltIHdvcmtpbmcgb24s IGFuZCBJIHRoaW5rIGl04oCZcyBwcmV0dHkgY2xlYXIgOikNCg0KSSBhbSBhbHNvIG5vdCBzdXJl IHdoeSB3ZSBzaG91bGQgcmVtb3ZlIHRoZSBoZWFkZXJzLiBEb27igJl0IHdlIG5lZWQgdGhhdCBp bmZvcm1hdGlvbj8NCg0KPjUuMi4xIG9mIHJmYzQ0NzRiaXMtMTAgY29udGFpbnMgdGhlIGNyaXNw ZXN0IHN0YXRlbWVudCBvZiB0aGUgc3ludGF4IG9mIGNhbm9uLCBwZXJoYXBzLCBidXQgaXQgaXMg bm90IHRoZSBqb2Igb2YgcmZjNDQ3NGJpcyB0byByZXBlYXQgdGhlIGd1aWRhbmNlIG9mDQo+UEFT U3BvclQgb24gaG93IHRvIGNvbnN0cnVjdCB0aGUgb2JqZWN0LiBQZXJoYXBzIGEgcG9pbnRlciB0 byB0aGF0IHNwZWNpZmljIHNlY3Rpb24gb2YgUEFTU3BvclQgd291bGQgaGVscD8NCg0KTXkgcXVl c3Rpb24gaXMgbm90IGhvdyB0byBjb25zdHJ1Y3QgdGhlIG9iamVjdCwgYnV0IGhvdyB0byBjb25z dHJ1Y3QgdGhlIOKAnGNhbm9u4oCdIGhlYWRlciBmaWVsZCB2YWx1ZSwgd2hpY2ggc2VlbXMgdG8g YmUgb25seSBhIHBhcnQgb2YgdGhlIG9iamVjdCBzdHJpbmcuDQoNClNlY3Rpb24gNS4yLjEgZGVz Y3JpYmVzIHdoaWNoIGNvbXBvbmVudHMgKGhlYWRlcnMgYW5kIGNsYWltcykgYXJlIHVzZWQgdG8g Y3JlYXRlIHRoZSDigJxjYW5vbuKAnSB2YWx1ZSwgYnV0IG5vdyBIT1cgaXTigJlzIGNyZWF0ZWQu DQoNClNvLCBJ4oCZZCBsaWtlIHRvIHN1Z2dlc3QgdGhhdCB3ZSB0cmFuc3BvcnQgdGhlIFBBU1Nw b3J0VCBvYmplY3Qgc3RyaW5nIGFzIHRoZSBJZGVudGl0eSBoZWFkZXIgZmllbGQgdmFsdWUsIGFu ZCBkb27igJl0IHVzZSDigJxjYW5vbuKAnS4gSSBhbSBoYXBweSB0byBoZWFyIHdoeSB3ZSBjYW7i gJl0IGRvIHRoYXQsIGJ1dCBzbyBmYXIgSSBoYXZlIG5vdCBoZWFyZC9yZWFkIGFueXRoaW5nIDop DQoNClRoYXQgd291bGQgYWxzbyBhbGxvdyBwZW9wbGUgdG8gdXNlIG9mZi10aGUtc2hlbGYgSldT IGVuY29kZXJzL2RlY29kZXJzLCBhbmQgd2Ugd291bGQgYXZvaWQgdGhlIGNvbmZ1c2lvbiBvZiB0 cmFuc3BvcnRpbmcgZGlmZmVyZW50IHBhcnRzIG9mIHRoZSBvYmplY3Qgc3RyaW5nIGluIGRpZmZl cmVudCBwbGFjZXMuDQoNClJlZ2FyZHMsDQoNCkNocmlzdGVyDQoNCg0KT24gSnVsIDE1LCAyMDE2 LCBhdCAyOjA5IEFNLCBDaHJpc3RlciBIb2xtYmVyZyA8Y2hyaXN0ZXIuaG9sbWJlcmdAZXJpY3Nz b24uY29tPG1haWx0bzpjaHJpc3Rlci5ob2xtYmVyZ0Blcmljc3Nvbi5jb20+PiB3cm90ZToNCkhp LA0KDQo+IFRoaXMgaXMgcGFydGx5IHRoZSBzYW1lIHF1ZXN0aW9uIGFzIHdlIGFyZSBleHBsb3Jp bmcgaW4gdGhlICJzeW50YXggY2hhbmdlIiB0aHJlYWQgZGlzY3Vzc2lvbiBvbiB3aGV0aGVyIG9y IG5vdCAiY2Fub24iIHdpbGwgYWx3YXlzIGJlIGluY2x1ZGVkLg0KDQpJdOKAmXMgbm90IHJlYWxs eSB0aGUgc2FtZS4gTXkgcXVlc3Rpb24gaXM6ICpJRiogdGhlIGNsYWltcyBhcmUgaW5jbHVkZWQs IHdoeSBkbyB3ZSBwdXQgdGhlbSBpbiBhIHNlcGFyYXRlIHBsYWNlICh0aGUg4oCcY2Fub27igJ0g aGVhZGVyIGZpZWxkIHBhcmFtZXRlcik/IFdoeSBkb27igJl0IHdlIHVzZSB0aGUgc3RhbmRhcmQg SldTIG1lY2hhbmlzbT8NCg0KPlRvIGFuc3dlciB5b3VyIHF1ZXN0aW9uLCB0aGluayBhYm91dCBp dCBhcyBpZiBTSVAgZG9lcyBub3QgY2FycnkgYSBKV1Mgb2JqZWN0LCBidXQgaW5zdGVhZCBpdCB0 cmFuc3BvcnRzIHNvbWUgZGF0YSB0aGF0IGFsbG93cyBhIHZlcmlmaWNhdGlvbiBzZXJ2aWNlDQo+ dG8gZ2VuZXJhdGUgYSBKV1Mgb2JqZWN0LiBTbyB3ZSdyZSBub3QgInNlbmRpbmciIHRoZSBKV1Mg b2JqZWN0LCBhbmQgdGh1cyB3ZSdyZSB1bmRlciBubyBvYmxpZ2F0aW9uIHRvICJzZW5kIGl0IGFz IG9uZSBzdHJpbmciIG9yIHdoYXRldmVyLg0KPg0KPlRoZSByZmM0NDc0YmlzICJjYW5vbiIgcGFy YW1ldGVyIG9wdGlvbmFsbHkgY29udGFpbnMgdGhlIGVuY29kZWQgcG9ydGlvbiBvZiB0aGUgaGVh ZGVyIGFuZCBjbGFpbXMgb2YgdGhlIEpXUyBvYmplY3QgYmVjYXVzZSB0aGUgaGVhZGVycyAoYW5k IGNsYWltcykgaW4gYmFzZWxpbmUgUEFTU3BvclQgYXJlIHVzdWFsbHkgcmVkdW5kYW50IHd0aCB0 aGUgY29udGVudHMgb2YgPmEgU0lQIHJlcXVlc3QgLSB3ZSBhbnRpY2lwYXRlIHRoYXQgYW55IHZl cmlmaWNhdGlvbiBzZXJ2aWNlIGNhbiBvcmRpbmFyaWx5IHJlZ2VuZXJhdGUgdGhvc2UgaGVhZGVy cyBhbmQgY2xhaW1zIGl0c2VsZiwgc28sIHRoZXJlJ3Mgbm8gb3N0ZW5zaWJsZSB2YWx1ZSBpbiBj YXJyeWluZyB0aGVtLiBHZW5lcmFsbHkgc3BlYWtpbmcsIHdlIHNob3VsZCBibG9hdGluZyBtZXNz YWdlcyA+d2l0aCByZWR1bmRhbnQgZmllbGRzIGlmIHdlIGNhbi4NCg0KSSBhZ3JlZS4gQnV0LCBB cHBlbmRpeCBGIGRlc2NyaWJlcyBob3cgdG8gZG8gdGhhdCB3aXRoIEpXUy4NCg0KPklmIHlvdSdy ZSBhc2tpbmcgd2h5IHdlIGNob3NlIHRvIGRlbWFyY2F0ZSB0aGF0IHdpdGggImNhbm9uIiByYXRo ZXIgdGhhbiBqdXN0IG5vdCBpbmNsdWRpbmcgdGhlIEpXUyBoZWFkZXIgYW5kIGNsYWltcyBpZiB3 ZSBkaWRuJ3QNCj53YW50IHRvIGluY2x1ZGUgdGhlIEpXUyBoZWFkZXIgYW5kIGNsYWltcywgaXQg aXMgZ2VuZXJhbGx5IGJldHRlciB0byBiZSBleHBsaWNpdCB0aGFuIHRvIGxlYXZlIHRoZSB2ZXJp ZmljYXRpb24gc2VydmljZSB0byBpbmZlciB3aGF0IGlzIGdvaW5nLg0KDQpJbiBteSBvcGluaW9u IGl04oCZcyBiZXR0ZXIgdG8gZm9sbG93IHRoZSBzdGFuZGFyZC4gQW5kLCBhZ2FpbiwgQXBwZW5k aXggRiBkZXNjcmliZXMgaG93IHRvIG5vdCBpbmNsdWRlZCB0aGUgY2xhaW1zIGluIGEgc3RhbmRh cmQgd2F5Lg0KDQpBbHNvLCBJIGFtIG5vdCBzdXJlIChuZWVkIHRvIHZlcmlmeSkgd2hldGhlciBp dOKAmXMgYWxsb3dlZCB0byByZW1vdmUgYWxsIGhlYWRlcnMuDQoNCkFsc28sICpJRiogd2Ugd2Fu dCB0byB1c2UgdGhlIOKAnGNhbm9u4oCdIGhlYWRlciBmaWVsZCBwYXJhbWV0ZXIsIHRoZSBkcmFm dCBkb2VzbuKAmXQgZ2l2ZSBlbm91Z2ggaW5mb3JtYXRpb24gb24gaG93IGl0IGlzIGdlbmVyYXRl ZC4NCg0KV2UgaGF2ZSB0aGUgZm9sbG93aW5nIHN5bnRheCBpbiBTZWN0aW9uIDg6DQoNCmNhbm9u aWNhbC1zdHIgPSAiY2Fub24iIEVRVUFMICpiYXNlNjQtY2hhcg0KDQrigKZhbmQsIGluIGEgZmV3 IHBsYWNlcyBvZiB0aGUgZG9jdW1lbnQgd2UgaGF2ZSB0ZXh0IGxpa2U6DQoNCuKAnFRoZSBzeW50 YXggb2YgImNhbm9uIiBpcyBnaXZlbiBpbiBTZWN0aW9uIDg7IGVzc2VudGlhbGx5LCBpdCBjb250 YWlucyBhIGJhc2U2NA0KICAgICAgICAgICAgICBlbmNvZGluZyBvZiB0aGUgSlNPTiBoZWFkZXIg YW5kIGNsYWltcyBpbiB0aGUgUEFTU3BvclQgb2JqZWN0LuKAnQ0KDQpCdXQsIEkgY2Fubm90IGZp bmQgdGV4dCBvbiBob3cgdGhhdCBiYXNlNjQtY2hhciBzdHJpbmcgaXMgZ2VuZXJhdGVkLiBZb3Ug aGF2ZSB0aGUgYmFzZTY0IGVuY29kaW5nIG9mIHRoZSBKU09OIGhlYWRlciwgYW5kIHRoZSBiYXNl NjQgZW5jb2Rpbmcgb2YgdGhlIGNsYWltcy4gSG93IGRvIHlvdSBjb21iaW5lIHRoZW0gaW50byB0 aGUgYmFzZTY0IGVuY29kZWQg4oCcY2Fub27igJ0gdmFsdWU/DQoNClJlZ2FyZHMsDQoNCkNocmlz dGVyDQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fIHN0 aXIgbWFpbGluZyBsaXN0IHN0aXJAaWV0Zi5vcmc8bWFpbHRvOnN0aXJAaWV0Zi5vcmc+IGh0dHBz Oi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vc3Rpcg0K --_000_E42CCDDA6722744CB241677169E836563F594E2BMISOUT7MSGUSRDB_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjojMDU2M0MxOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFu Lk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjoj OTU0RjcyOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KcC5Nc29MaXN0UGFyYWdyYXBo LCBsaS5Nc29MaXN0UGFyYWdyYXBoLCBkaXYuTXNvTGlzdFBhcmFncmFwaA0KCXttc28tc3R5bGUt cHJpb3JpdHk6MzQ7DQoJbWFyZ2luLXRvcDowaW47DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltYXJn aW4tYm90dG9tOjBpbjsNCgltYXJnaW4tbGVmdDouNWluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFw dDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlm O30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQt ZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0Kc3Bhbi5F bWFpbFN0eWxlMTkNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6IkNh bGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6IzFGNDk3RDt9DQpzcGFuLkVtYWlsU3R5bGUyMA0K CXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1z ZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCnNwYW4uRW1haWxTdHlsZTIxDQoJe21zby1zdHls ZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNv bG9yOiMxRjQ5N0Q7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjINCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29u YWw7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4 dDt9DQpzcGFuLkVtYWlsU3R5bGUyMw0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250 LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCnNwYW4u RW1haWxTdHlsZTI0DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJD YWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOiMxRjQ5N0Q7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjUN Cgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMt c2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQpzcGFuLkVtYWlsU3R5bGUyNg0KCXttc28tc3R5 bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJp ZjsNCgljb2xvcjojMUY0OTdEO30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4 cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3Np emU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYu V29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBn dGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIx MDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpz aGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIg Lz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGJn Y29sb3I9IndoaXRlIiBsYW5nPSJFTi1VUyIgbGluaz0iIzA1NjNDMSIgdmxpbms9IiM5NTRGNzIi Pg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJjb2xvcjojMUY0OTdEIj5Db25jZXJuaW5nIHRoYXQgb25lIG9mIG91ciBsYXJnZXN0 IHZlbmRvciBoYXMgaW50ZXJvcGVyYWJpbGl0eSBjb25jZXJuczxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iY29sb3I6IzFGNDk3RCI+SSB0cnVzdCBDaHJpc3RlciB3aGVuIGhlIHNheXMgdGhlIGNoYW5n ZSBzaG91bGQgbm90IGJlIGEgYmlnIHRhc2ssIHNvIHBsZWFzZSBtYWtlIGl0LjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0 OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9y ZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGlu IDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+RnJvbTo8L2I+IHN0aXIgW21haWx0 bzpzdGlyLWJvdW5jZXNAaWV0Zi5vcmddIDxiPk9uIEJlaGFsZiBPZg0KPC9iPkNocmlzdGVyIEhv bG1iZXJnPGJyPg0KPGI+U2VudDo8L2I+IFNhdHVyZGF5LCBKdWx5IDE2LCAyMDE2IDQ6MDAgUE08 YnI+DQo8Yj5Ubzo8L2I+IFJpY2hhcmQgU2hvY2tleSAmbHQ7cmljaGFyZEBzaG9ja2V5LnVzJmd0 OzsgUGV0ZXJzb24sIEpvbiAmbHQ7am9uLnBldGVyc29uQG5ldXN0YXIuYml6Jmd0Ozxicj4NCjxi PkNjOjwvYj4gSUVURiBTVElSIE1haWwgTGlzdCAmbHQ7c3RpckBpZXRmLm9yZyZndDs8YnI+DQo8 Yj5TdWJqZWN0OjwvYj4gUmU6IFtzdGlyXSBTZXBhcmF0aW9uIG9mIEpXUzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJjb2xv cjojMUY0OTdEIj5IaSw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBz dHlsZT0iY29sb3I6IzFGNDk3RCI+SSBhbSBjb21tZW50aW5nIHdpdGggYW4gaW1wbGVtZW50ZXIg aGF0IG9uLCBhbmQgSSBkb27igJl0IHRoaW5rIHdlIHNob3VsZCBhY2NlcHQgd2hhdCB3ZSBoYXZl IG5vdy4gSW4gbXkgb3BpbmlvbiB0aGVyZSB3b3VsZCBiZSBpbnRlcm9wIGlzc3VlcyBmcm9tIGRh eSBvbmUsIGJlY2F1c2UgMSkgd2UgYXJlIOKAnHNwbGl0dGluZ+KAnSB0aGUgZW5jb2RlZA0KIEpX UyBzdHJpbmcgaW50byBkaWZmZXJlbnQgcGllY2VzLCBhbmQgMikgaXQgaXMgbm90IGNsZWFyIGhv dyB0aGUgZW5jb2Rpbmcgb2YgdGhhdCB3aWxsIGxvb2sgbGlrZS48bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImNvbG9y OiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+TXkgc3VnZ2VzdGlv biBpcyB0byBzZW5kIHRoZSB3aG9sZSBlbmNvZGVkIFBhc3NQT1JUIEpXUyBvYmplY3Qgc3RyaW5n IGFzIHRoZSBJZGVudGl0eSBoZWFkZXIgZmllbGQgdmFsdWUsIGFjY29yZGluZyB0byB0aGUgSldT IHN0YW5kYXJkLCBhbmQgZHJvcCB0aGUg4oCcY2Fub27igJ0gaGVhZGVyIGZpZWxkIHBhcmFtZXRl ci4gVGhhdCB3YXMgbXkgYXNzdW1wdGlvbg0KIHNpbmNlIHRoZSBkYXkgd2UgYWRvcHRlZCBKV1Mu IEkgc3RpbGwgYWxsb3dzIG5vdCBzZW5kaW5nIHRoZSBjbGFpbXMgaW4gYSBzdGFuZGFyZCBtYW5u ZXIuIEkgYWxzbyBkb27igJl0IHRoaW5rIGl0IHNob3VsZCBiZSBhbGxvd2VkIHRvIGRyb3AgdGhl IG1hbmRhdG9yeSBKV1MgaGVhZGVycy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9 IkVOLUdCIiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+RG9pbmcgdGhlIGNoYW5nZSBpbiB0aGUgZHJh ZnQgc2hvdWxkIG5vdCBiZSBhIGJpZyB0YXNrLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+ PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g bGFuZz0iRU4tR0IiIHN0eWxlPSJjb2xvcjojMUY0OTdEIj5SZWdhcmRzLDxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0i Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJjb2xvcjojMUY0OTdEIj5DaHJpc3Rl cjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9 IkVOLUdCIiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJjb2xvcjoj MUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxhIG5hbWU9Il9NYWlsRW5kQ29t cG9zZSI+PC9hPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2Jv cmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPkZyb206PC9iPiBSaWNoYXJkIFNob2NrZXkgWzxhIGhy ZWY9Im1haWx0bzpyaWNoYXJkQHNob2NrZXkudXMiPm1haWx0bzpyaWNoYXJkQHNob2NrZXkudXM8 L2E+XQ0KPGJyPg0KPGI+U2VudDo8L2I+IDE2IEp1bHkgMjAxNiAxMzoyOTxicj4NCjxiPlRvOjwv Yj4gQ2hyaXN0ZXIgSG9sbWJlcmcgJmx0OzxhIGhyZWY9Im1haWx0bzpjaHJpc3Rlci5ob2xtYmVy Z0Blcmljc3Nvbi5jb20iPmNocmlzdGVyLmhvbG1iZXJnQGVyaWNzc29uLmNvbTwvYT4mZ3Q7OyBQ ZXRlcnNvbiwgSm9uICZsdDs8YSBocmVmPSJtYWlsdG86am9uLnBldGVyc29uQG5ldXN0YXIuYml6 Ij5qb24ucGV0ZXJzb25AbmV1c3Rhci5iaXo8L2E+Jmd0Ozxicj4NCjxiPkNjOjwvYj4gSUVURiBT VElSIE1haWwgTGlzdCAmbHQ7PGEgaHJlZj0ibWFpbHRvOnN0aXJAaWV0Zi5vcmciPnN0aXJAaWV0 Zi5vcmc8L2E+Jmd0Ozxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW3N0aXJdIFNlcGFyYXRpb24g b2YgSldTPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gbGFuZz0iRU4tR0IiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+Q2hyaXN0ZXIgaWYgeW91IGFyZSBmcnVzdHJhdGVkIEkgY2VydGFpbmx5IHVuZGVyc3RhbmQu Jm5ic3A7Jm5ic3A7IDxvOnA+DQo8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkFzIEkgaGF2ZSByZWFkIHRo cm91Z2ggdjEwIGhlcmUgSeKAmW0gd29uZGVyaW5nIGhvdyBpdCBjYW4gYmUgc3VjY2Vzc2Z1bGx5 IGltcGxlbWVudGVkIGJ5IHRoZSB2ZW5kb3IgY29tbXVuaXR5LiZuYnNwOyBUaGVyZSBpcyBjbGVh cmx5IHN0cm9uZywgaW4gZmFjdCBvdmVyd2hlbG1pbmcgZGVtYW5kIHRvIGltcGxlbWVudCB0aGlz IGJ1dCB0aGUgbGFzdCB0aGluZyB3ZSBuZWVkIGFyZSB0aGUga2luZHMgb2YgYmFrZWQgaW4gaW50 ZXJvcGVyYWJpbGl0eQ0KIHByb2JsZW1zIHdlIGhhdmUgc2VlbiBpbiBWb0xURSwgZm9yIGluc3Rh bmNlLiAmbmJzcDtJIGNhbiBhc3N1cmUgeW91IHRoZSBOUkHigJlzIGhhdmUgYmVlbiB0b2xkIHdl IGhhdmUgYSBzb2x1dGlvbiBidXQgd2UgcmVhbGlzdGljYWxseSBuZWVkIHRvIGdpdmUgdGhlbSBz b21lIGltcGxlbWVudGF0aW9uIHRpbWVsaW5lcy4NCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5U aGUgbGFjayBvZiBhY3R1YWwgZnVsbCBleGFtcGxlcyBvZiBhIHR5cGljYWwgb3JpZ2luYXRpbmcg SU5WSVRFLCBpcyBhcHBhbGxpbmcuICZuYnNwO0kgaGF2ZSBzZXJpb3VzIHF1ZXN0aW9ucyB3aGV0 aGVyIHRoaXMgZG9jdW1lbnQgaXMgcmVhZHkgZm9yIGFkb3B0aW9uLiZuYnNwOw0KPG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPlNob3VsZCB3ZSBqdXN0IGFjY2VwdCB3aGF0IHdlIGhhdmUgbm93PyZu YnNwOyBTaG91bGQgdGhlIFNJUCBGb3J1bSBpbW1lZGlhdGVseSBsb29rIGludG8gc29tZSBvbmdv aW5nIHByb2ZpbGUgd29yayBoZXJlIGFzIHdlIHN0YXJ0IGRvd24gdGhpcyByb2FkPyAmbmJzcDsm bmJzcDtJIGtub3cgUm9iZXJ0IHdvdWxkIGxpa2UgdG8gc2VlIHNvbWUgZXhhbXBsZXMgb2YgaW1w bGVtZW50YXRpb25zIGF0IFNJUGl0IGJ1dCBpcyB0aGVyZSBlbm91Z2gNCiB0aW1lIGdpdmVuIHRo ZSBvbmdvaW5nIHF1ZXN0aW9ucyB0aGUgZG9jdW1lbnQgZG9lcyBub3QgYW5zd2VyLiA8bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC41cHQ7Y29sb3I6YmxhY2siPuKAlCZuYnNw OzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuNXB0O2NvbG9yOmJsYWNrIj5SaWNoYXJkIFNo b2NrZXk8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdDtjb2xvcjpibGFjayI+U2hvY2tl eSBDb25zdWx0aW5nIExMQzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuNXB0O2NvbG9yOmJs YWNrIj5DaGFpcm1hbiBvZiB0aGUgQm9hcmQgU0lQIEZvcnVtPG86cD48L286cD48L3NwYW4+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMC41cHQ7Y29sb3I6YmxhY2siPjxhIGhyZWY9Imh0dHA6Ly93d3cuc2hvY2tleS51cyI+ d3d3LnNob2NrZXkudXM8L2E+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC41cHQ7Y29sb3I6 YmxhY2siPjxhIGhyZWY9Imh0dHA6Ly93d3cuc2lwZm9ydW0ub3JnIj53d3cuc2lwZm9ydW0ub3Jn PC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuNXB0O2NvbG9yOmJsYWNrIj5yaWNoYXJk Jmx0O2F0Jmd0O3Nob2NrZXkudXM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdDtjb2xv cjpibGFjayI+U2t5cGUtTGlua2VkaW4tRmFjZWJvb2sgcnNob2NrZXkxMDE8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjEwLjVwdDtjb2xvcjpibGFjayI+UFNUTiAmIzQzOzEgNzAzLTU5My0yNjgz PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNC NUM0REYgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48Yj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPkZyb206IDwvc3Bhbj48L2I+PHNwYW4g c3R5bGU9ImNvbG9yOmJsYWNrIj5zdGlyICZsdDs8YSBocmVmPSJtYWlsdG86c3Rpci1ib3VuY2Vz QGlldGYub3JnIj5zdGlyLWJvdW5jZXNAaWV0Zi5vcmc8L2E+Jmd0OyBvbiBiZWhhbGYgb2YgQ2hy aXN0ZXIgSG9sbWJlcmcgJmx0OzxhIGhyZWY9Im1haWx0bzpjaHJpc3Rlci5ob2xtYmVyZ0Blcmlj c3Nvbi5jb20iPmNocmlzdGVyLmhvbG1iZXJnQGVyaWNzc29uLmNvbTwvYT4mZ3Q7PGJyPg0KPGI+ RGF0ZTogPC9iPkZyaWRheSwgSnVseSAxNSwgMjAxNiBhdCA1OjM1IFBNPGJyPg0KPGI+VG86IDwv Yj4mcXVvdDtQZXRlcnNvbiwgSm9uJnF1b3Q7ICZsdDs8YSBocmVmPSJtYWlsdG86am9uLnBldGVy c29uQG5ldXN0YXIuYml6Ij5qb24ucGV0ZXJzb25AbmV1c3Rhci5iaXo8L2E+Jmd0Ozxicj4NCjxi PkNjOiA8L2I+SUVURiBTVElSIE1haWwgTGlzdCAmbHQ7PGEgaHJlZj0ibWFpbHRvOnN0aXJAaWV0 Zi5vcmciPnN0aXJAaWV0Zi5vcmc8L2E+Jmd0Ozxicj4NCjxiPlN1YmplY3Q6IDwvYj5SZTogW3N0 aXJdIFNlcGFyYXRpb24gb2YgSldTPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0 O2NvbG9yOmJsYWNrIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7VGltZXMgTmV3 IFJvbWFuJnF1b3Q7LHNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0 eWxlPSJjb2xvcjojMUY0OTdEIj5IaSw8L3NwYW4+PHNwYW4gbGFuZz0iRU4tR0IiPjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj4m bmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj4mZ3Q7T2gsIHlvdSBtZWFudCBBcHBlbmRpeCBGIG9m IFJGQzc1MTUuIEkgaGFkIHRob3VnaHQgeW91IHNhaWQgUkZDNzMxNSBpbiB5b3VyIG90aGVyIG1h aWwsIHNvIHBlcmhhcHMgeW91IGNhbiB1bmRlcnN0YW5kIG15IGNvbmZ1c2lvbi4gJm5ic3A7PG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4t R0IiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIGxhbmc9IkVOLUdCIj5Tb3JyeSA6KTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj4mbmJzcDs8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBsYW5nPSJFTi1HQiI+Jmd0O015IHJlYWRpbmcgb2YgdGhhdCBpcyB0aGF0IGl0IGNhbiBy ZW1vdmUgdGhlIGNsYWltcyBidXQgbm90IHRoZSBoZWFkZXIuIEJ1dCBpdCdzIGFsc28gbm90IHN1 cGVyIHNwZWNpZmljIGFib3V0IGhvdyBpdCB3b3Jrcy4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+Jm5ic3A7PG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0Ii PldoYXQgZG8geW91IHRoaW5rIGlzIHVuY2xlYXI/PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiPiZuYnNwOzxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj5JIGFtIHVz aW5nIGl0IGZvciBhIGRyYWZ0IEnigJltIHdvcmtpbmcgb24sIGFuZCBJIHRoaW5rIGl04oCZcyBw cmV0dHkgY2xlYXIgOik8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBsYW5nPSJFTi1HQiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiPkkgYW0gYWxzbyBub3Qgc3VyZSB3aHkg d2Ugc2hvdWxkIHJlbW92ZSB0aGUgaGVhZGVycy4gRG9u4oCZdCB3ZSBuZWVkIHRoYXQgaW5mb3Jt YXRpb24/PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj4m Z3Q7NS4yLjEgb2YgcmZjNDQ3NGJpcy0xMCBjb250YWlucyB0aGUgY3Jpc3Blc3Qgc3RhdGVtZW50 IG9mIHRoZSBzeW50YXggb2YgY2Fub24sIHBlcmhhcHMsIGJ1dCBpdCBpcyBub3QgdGhlIGpvYiBv ZiByZmM0NDc0YmlzIHRvIHJlcGVhdCB0aGUgZ3VpZGFuY2Ugb2YNCjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj4mZ3Q7UEFTU3Bv clQgb24gaG93IHRvIGNvbnN0cnVjdCB0aGUgb2JqZWN0LiBQZXJoYXBzIGEgcG9pbnRlciB0byB0 aGF0IHNwZWNpZmljIHNlY3Rpb24gb2YgUEFTU3BvclQgd291bGQgaGVscD88bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+Jm5ic3A7 PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0i RU4tR0IiPk15IHF1ZXN0aW9uIGlzIG5vdCBob3cgdG8gY29uc3RydWN0IHRoZSBvYmplY3QsIGJ1 dCBob3cgdG8gY29uc3RydWN0IHRoZSDigJxjYW5vbuKAnSBoZWFkZXIgZmllbGQgdmFsdWUsIHdo aWNoIHNlZW1zIHRvIGJlIG9ubHkgYSBwYXJ0IG9mIHRoZSBvYmplY3Qgc3RyaW5nLg0KPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0Ii PiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IGxhbmc9IkVOLUdCIj5TZWN0aW9uIDUuMi4xIGRlc2NyaWJlcyB3aGljaCBjb21wb25lbnRzICho ZWFkZXJzIGFuZCBjbGFpbXMpIGFyZSB1c2VkIHRvIGNyZWF0ZSB0aGUg4oCcY2Fub27igJ0gdmFs dWUsIGJ1dCBub3cgSE9XIGl04oCZcyBjcmVhdGVkLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj4mbmJzcDs8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+U28sIEni gJlkIGxpa2UgdG8gc3VnZ2VzdCB0aGF0IHdlIHRyYW5zcG9ydCB0aGUgUEFTU3BvcnRUIG9iamVj dCBzdHJpbmcgYXMgdGhlIElkZW50aXR5IGhlYWRlciBmaWVsZCB2YWx1ZSwgYW5kIGRvbuKAmXQg dXNlIOKAnGNhbm9u4oCdLiBJIGFtIGhhcHB5IHRvIGhlYXIgd2h5IHdlIGNhbuKAmXQgZG8gdGhh dCwgYnV0IHNvIGZhciBJIGhhdmUgbm90IGhlYXJkL3JlYWQgYW55dGhpbmcgOik8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+Jm5i c3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFu Zz0iRU4tR0IiPlRoYXQgd291bGQgYWxzbyBhbGxvdyBwZW9wbGUgdG8gdXNlIG9mZi10aGUtc2hl bGYgSldTIGVuY29kZXJzL2RlY29kZXJzLCBhbmQgd2Ugd291bGQgYXZvaWQgdGhlIGNvbmZ1c2lv biBvZiB0cmFuc3BvcnRpbmcgZGlmZmVyZW50IHBhcnRzIG9mIHRoZSBvYmplY3Qgc3RyaW5nIGlu IGRpZmZlcmVudCBwbGFjZXMuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj5SZWdhcmRzLDxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj4mbmJz cDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5n PSJFTi1HQiI+Q2hyaXN0ZXI8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIu MHB0Ij48c3BhbiBsYW5nPSJFTi1HQiI+PGJyPg0KT24gSnVsIDE1LCAyMDE2LCBhdCAyOjA5IEFN LCBDaHJpc3RlciBIb2xtYmVyZyAmbHQ7PGEgaHJlZj0ibWFpbHRvOmNocmlzdGVyLmhvbG1iZXJn QGVyaWNzc29uLmNvbSI+Y2hyaXN0ZXIuaG9sbWJlcmdAZXJpY3Nzb24uY29tPC9hPiZndDsgd3Jv dGU6PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFy Z2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPkhpLDwvc3Bh bj48c3BhbiBsYW5nPSJFTi1HQiI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjEwLjVw dDtjb2xvcjpibGFjayI+Jm5ic3A7PC9zcGFuPjxzcGFuIGxhbmc9IkVOLUdCIj48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBs YW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMC41cHQiPiZndDsgPHNwYW4gc3R5bGU9ImNv bG9yOmJsYWNrIj4NClRoaXMgaXMgcGFydGx5IHRoZSBzYW1lIHF1ZXN0aW9uIGFzIHdlIGFyZSBl eHBsb3JpbmcgaW4gdGhlICZxdW90O3N5bnRheCBjaGFuZ2UmcXVvdDsgdGhyZWFkIGRpc2N1c3Np b24gb24gd2hldGhlciBvciBub3QgJnF1b3Q7Y2Fub24mcXVvdDsgd2lsbCBhbHdheXMgYmUgaW5j bHVkZWQuPC9zcGFuPjwvc3Bhbj48c3BhbiBsYW5nPSJFTi1HQiI+PG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiPiZuYnNwOzxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdC Ij5JdOKAmXMgbm90IHJlYWxseSB0aGUgc2FtZS4gTXkgcXVlc3Rpb24gaXM6ICo8Yj5JRjwvYj4q IHRoZSBjbGFpbXMgYXJlIGluY2x1ZGVkLCB3aHkgZG8gd2UgcHV0IHRoZW0gaW4gYSBzZXBhcmF0 ZSBwbGFjZSAodGhlIOKAnGNhbm9u4oCdIGhlYWRlciBmaWVsZCBwYXJhbWV0ZXIpPyBXaHkgZG9u 4oCZdCB3ZSB1c2UgdGhlIHN0YW5kYXJkIEpXUyBtZWNoYW5pc20/PG86cD48L286cD48L3NwYW4+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4t R0IiIHN0eWxlPSJmb250LXNpemU6MTAuNXB0O2NvbG9yOmJsYWNrIj4mbmJzcDs8L3NwYW4+PHNw YW4gbGFuZz0iRU4tR0IiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjEw LjVwdCI+Jmd0OzxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+VG8gYW5zd2VyIHlvdXIgcXVlc3Rp b24sIHRoaW5rIGFib3V0IGl0IGFzIGlmIFNJUCBkb2VzIG5vdCBjYXJyeSBhIEpXUyBvYmplY3Qs IGJ1dCBpbnN0ZWFkIGl0IHRyYW5zcG9ydHMgc29tZSBkYXRhIHRoYXQgYWxsb3dzIGEgdmVyaWZp Y2F0aW9uIHNlcnZpY2UNCjwvc3Bhbj48L3NwYW4+PHNwYW4gbGFuZz0iRU4tR0IiPjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj4m Z3Q7PC9zcGFuPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdDtjb2xv cjpibGFjayI+dG8gZ2VuZXJhdGUgYSBKV1Mgb2JqZWN0LiBTbyB3ZSdyZSBub3QgJnF1b3Q7c2Vu ZGluZyZxdW90OyB0aGUgSldTIG9iamVjdCwgYW5kIHRodXMgd2UncmUgdW5kZXIgbm8gb2JsaWdh dGlvbiB0byAmcXVvdDtzZW5kIGl0IGFzIG9uZSBzdHJpbmcmcXVvdDsgb3Igd2hhdGV2ZXIuPC9z cGFuPjxzcGFuIGxhbmc9IkVOLUdCIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQt c2l6ZToxMC41cHQiPiZndDs8c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48 L3NwYW4+PHNwYW4gbGFuZz0iRU4tR0IiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9u dC1zaXplOjEwLjVwdCI+Jmd0OzxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+VGhlIHJmYzQ0NzRi aXMgJnF1b3Q7Y2Fub24mcXVvdDsgcGFyYW1ldGVyIG9wdGlvbmFsbHkgY29udGFpbnMgdGhlIGVu Y29kZWQgcG9ydGlvbiBvZiB0aGUgaGVhZGVyIGFuZCBjbGFpbXMgb2YgdGhlIEpXUyBvYmplY3Qg YmVjYXVzZSB0aGUgaGVhZGVycyAoYW5kIGNsYWltcykgaW4gYmFzZWxpbmUgUEFTU3BvclQNCiBh cmUgdXN1YWxseSByZWR1bmRhbnQgd3RoIHRoZSBjb250ZW50cyBvZiA8L3NwYW4+Jmd0OzxzcGFu IHN0eWxlPSJjb2xvcjpibGFjayI+YSBTSVAgcmVxdWVzdCAtIHdlIGFudGljaXBhdGUgdGhhdCBh bnkgdmVyaWZpY2F0aW9uIHNlcnZpY2UgY2FuIG9yZGluYXJpbHkgcmVnZW5lcmF0ZSB0aG9zZSBo ZWFkZXJzIGFuZCBjbGFpbXMgaXRzZWxmLCBzbywgdGhlcmUncyBubyBvc3RlbnNpYmxlIHZhbHVl IGluIGNhcnJ5aW5nIHRoZW0uIEdlbmVyYWxseSBzcGVha2luZywNCiB3ZSBzaG91bGQgYmxvYXRp bmcgbWVzc2FnZXMgPC9zcGFuPiZndDs8c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPndpdGggcmVk dW5kYW50IGZpZWxkcyBpZiB3ZSBjYW4uJm5ic3A7PC9zcGFuPjwvc3Bhbj48c3BhbiBsYW5nPSJF Ti1HQiI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTAuNXB0Ij4mbmJz cDs8L3NwYW4+PHNwYW4gbGFuZz0iRU4tR0IiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj5JIGFncmVlLiBCdXQsIEFwcGVuZGl4 IEYgZGVzY3JpYmVzIGhvdyB0byBkbyB0aGF0IHdpdGggSldTLg0KPG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiPiZuYnNwOzxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdCI+Jmd0OzxzcGFuIHN0eWxl PSJjb2xvcjpibGFjayI+SWYgeW91J3JlIGFza2luZyB3aHkgd2UgY2hvc2UgdG8gZGVtYXJjYXRl IHRoYXQgd2l0aCAmcXVvdDtjYW5vbiZxdW90OyByYXRoZXIgdGhhbiBqdXN0IG5vdCBpbmNsdWRp bmcgdGhlIEpXUyBoZWFkZXIgYW5kIGNsYWltcyBpZiB3ZSBkaWRuJ3QNCjwvc3Bhbj48L3NwYW4+ PHNwYW4gbGFuZz0iRU4tR0IiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj4mZ3Q7PC9zcGFuPjxzcGFuIGxhbmc9IkVOLUdCIiBz dHlsZT0iZm9udC1zaXplOjEwLjVwdDtjb2xvcjpibGFjayI+d2FudCB0byBpbmNsdWRlIHRoZSBK V1MgaGVhZGVyIGFuZCBjbGFpbXMsIGl0IGlzIGdlbmVyYWxseSBiZXR0ZXIgdG8gYmUgZXhwbGlj aXQgdGhhbiB0byBsZWF2ZSB0aGUgdmVyaWZpY2F0aW9uIHNlcnZpY2UgdG8gaW5mZXIgd2hhdCBp cyBnb2luZy48L3NwYW4+PHNwYW4gbGFuZz0iRU4tR0IiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBz dHlsZT0iZm9udC1zaXplOjEwLjVwdCI+Jm5ic3A7PC9zcGFuPjxzcGFuIGxhbmc9IkVOLUdCIj48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJF Ti1HQiI+SW4gbXkgb3BpbmlvbiBpdOKAmXMgYmV0dGVyIHRvIGZvbGxvdyB0aGUgc3RhbmRhcmQu IEFuZCwgYWdhaW4sIEFwcGVuZGl4IEYgZGVzY3JpYmVzIGhvdyB0byBub3QgaW5jbHVkZWQgdGhl IGNsYWltcyBpbiBhIHN0YW5kYXJkIHdheS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiPkFsc28sIEkgYW0g bm90IHN1cmUgKG5lZWQgdG8gdmVyaWZ5KSB3aGV0aGVyIGl04oCZcyBhbGxvd2VkIHRvIHJlbW92 ZSBhbGwgaGVhZGVycy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBsYW5nPSJFTi1HQiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiPkFsc28sICo8Yj5JRjwvYj4qIHdlIHdh bnQgdG8gdXNlIHRoZSDigJxjYW5vbuKAnSBoZWFkZXIgZmllbGQgcGFyYW1ldGVyLCB0aGUgZHJh ZnQgZG9lc27igJl0IGdpdmUgZW5vdWdoIGluZm9ybWF0aW9uIG9uIGhvdyBpdCBpcyBnZW5lcmF0 ZWQuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFu Zz0iRU4tR0IiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIGxhbmc9IkVOLUdCIj5XZSBoYXZlIHRoZSBmb2xsb3dpbmcgc3ludGF4IGluIFNl Y3Rpb24gODo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBsYW5nPSJFTi1HQiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9InRleHQtaW5kZW50Oi41aW4iPjxzcGFuIGxhbmc9IkVOLUdCIj5jYW5v bmljYWwtc3RyID0gJnF1b3Q7Y2Fub24mcXVvdDsgRVFVQUwgKmJhc2U2NC1jaGFyPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiPiZu YnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxh bmc9IkVOLUdCIj7igKZhbmQsIGluIGEgZmV3IHBsYWNlcyBvZiB0aGUgZG9jdW1lbnQgd2UgaGF2 ZSB0ZXh0IGxpa2U6PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gbGFuZz0iRU4tR0IiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJ0ZXh0LWluZGVudDouNWluIj48c3BhbiBsYW5nPSJFTi1HQiI+ 4oCcVGhlIHN5bnRheCBvZiAmcXVvdDtjYW5vbiZxdW90OyBpcyBnaXZlbiBpbiBTZWN0aW9uIDg7 IGVzc2VudGlhbGx5LCBpdCBjb250YWlucyBhIGJhc2U2NDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj4mbmJzcDsmbmJzcDsgJm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 IGVuY29kaW5nIG9mIHRoZSBKU09OIGhlYWRlciBhbmQgY2xhaW1zIGluIHRoZSBQQVNTcG9yVCBv YmplY3Qu4oCdPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gbGFuZz0iRU4tR0IiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj5CdXQsIEkgY2Fubm90IGZpbmQgdGV4dCBvbiBo b3cgdGhhdCBiYXNlNjQtY2hhciBzdHJpbmcgaXMgZ2VuZXJhdGVkLiBZb3UgaGF2ZSB0aGUgYmFz ZTY0IGVuY29kaW5nIG9mIHRoZSBKU09OIGhlYWRlciwgYW5kIHRoZSBiYXNlNjQgZW5jb2Rpbmcg b2YgdGhlIGNsYWltcy4gSG93IGRvIHlvdSBjb21iaW5lIHRoZW0gaW50byB0aGUgYmFzZTY0IGVu Y29kZWQg4oCcY2Fub27igJ0gdmFsdWU/PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj5SZWdhcmRzLDxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdC Ij4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBsYW5nPSJFTi1HQiI+Q2hyaXN0ZXI8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyxzZXJpZiI+X19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18gc3RpciBtYWlsaW5nIGxpc3QNCjxhIGhy ZWY9Im1haWx0bzpzdGlyQGlldGYub3JnIj5zdGlyQGlldGYub3JnPC9hPiA8YSBocmVmPSJodHRw czovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3N0aXIiPg0KaHR0cHM6Ly93d3cuaWV0 Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9zdGlyPC9hPiA8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_E42CCDDA6722744CB241677169E836563F594E2BMISOUT7MSGUSRDB_-- From nobody Mon Jul 18 05:47:43 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5E8E012D9A9 for ; Mon, 18 Jul 2016 05:47:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id X7ZOnNEsrglR for ; Mon, 18 Jul 2016 05:47:39 -0700 (PDT) Received: from smtp7.webway.se (smtp7.webway.se [212.3.14.205]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4469312D9A4 for ; Mon, 18 Jul 2016 05:47:38 -0700 (PDT) Received: from dhcp-a2d2.meeting.ietf.org (dhcp-a2d2.meeting.ietf.org [31.133.162.210]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp7.webway.se (Postfix) with ESMTPSA id 14CEA428B; Mon, 18 Jul 2016 14:47:34 +0200 (CEST) From: Olle E. Johansson Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Mon, 18 Jul 2016 14:47:31 +0200 Message-Id: To: IETF STIR Mail List Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) X-Mailer: Apple Mail (2.3124) Archived-At: Cc: Olle E Johansson Subject: [stir] Comments on draft-ietf-stir-rfc4474bis-10 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Jul 2016 12:47:42 -0000 Hi! I=E2=80=99ve been reading this draft and have a few nits and some = general comments below. (and yes, I=E2=80=99ve double-checked and it=E2=80=99s the WG adopted = draft I read as opposed to what I emailed earlier. Some notes added in this e-mail). Section 3 - Maybe add subparagraphs for SIP URI=E2=80=99s and telephone numbers. = It=E2=80=99s a very long section. - section 3, page 5 =E2=80=9CThe authentication service then computes a signature over those JSON object in a manner following PASSporT.=E2=80=9D s/those/that/ - =E2=80=9CIn these cases, implementation the authentication service at = an intermediary may be more practical.=E2=80=9D s/implementation/implementing/ Section 5.1 - =E2=80=9CThe procedures below define the steps that must be taken when = each an header is added.=E2=80=9D s/an // Section 5.1 step 4 - =E2=80=9CSubsequently, the authentication service MUST form a = PASSporT object and add a corresponding an Identity header to the request containing this signature.=E2=80=9D s/an Identity/Identity/ Section 5.1 step 5 - =E2=80=9CFinally, the authentication service MUST forward the = message normally.=E2=80=9D What is normal? Section 5.2: - =E2=80=9CIf the verifier does not support an Identity header present in a request due to the presence of an unsupported "ppt" parameter, or if no Identity header is present, and the presence of an Identity header is required by local policy (for example, based on a per-sending-domain policy, or a per-sending-user policy), then a 428 'Use Identity Header' response MUST be sent in the backwards direction. =E2=80=9C It seems that the reason text used here doesn=E2=80=99t match the = problem. If there is an identity header with an unsupported parameter - should this message not be conveyed back either in the response code or in an additional header, like a warning code saying =E2=80=9Cunsupported = ppt param=E2=80=9D. Section 5.2 Step 1: - =E2=80=9CThe verifier MUST inspect any optional "ppt" = parameter appearing the Identity request.=E2=80=9D s/appearing/appearing in / Step 4: - Does not describe actions to take if the date is outside of the = accepted range. Step 5: - =E2=80=9CThe handling of the message after the verification process depends on how the implementation service is implemented and on local policy.=E2=80=9D Do you really mean =E2=80=9Cimplementation service=E2=80=9D? Maybe = =E2=80=9Cverification service=E2=80=9D ? Section 5.2.1: - =E2=80=9CIf the optional "canon" parameter of the Identity header is = present, it contains a base64 encoding of the header and claim component of the PASSporT object constructed by the authentication service, and this it conveys any canonical telephone number formats created by the authentication service (see Section 7.2), as well as an "iat" claim corresponding to the Date header that the authentication service used.=E2=80=9D The phrase =E2=80=9Cthis it=E2=80=9D seems wrong to me, maybe you mean = =E2=80=9Cthus it=E2=80=9D. The sentence is awfully long and complex. Section 6.2: - =E2=80=9CProvided that the credential used to sign a message is not previously known to the verifier, SIP entities SHOULD discover this credential by dereferencing the "info" parameter, unless they have some more other implementation-specific way of acquiring the needed keying material, such as an offline store of periodically-updated credentials.=E2=80=9D =E2=80=9Csome more other=E2=80=9D seems like you have one word too many.=20= Section 6.3 - =E2=80=9CFor example, imagine a case where a domain implements the authentication service role for a range of telephone and a user agent belonging to Alice has acquired a credential for a single telephone number within that range. =E2=80=9C Range of telephone WHAT? Numbers? Section 7: - =E2=80=9CUltimately, in any case where local policy canonicalizes the = idenity=E2=80=9D .. - s/idenity/identity/ Section 7.3 - =E2=80=9Cdomain signature=E2=80=9D is not explained - I don=E2=80=99t really like the last paragraph. In RFC 5922 SIP Domain = Certificates wildcard certificates are banned, which is not the case in = RFC 2818. 5922 seems to me a better reference, especially if we want to = be able to use the same certificate and keys. RFC 6125 section 6.4. is = also a bit more up to date on verification of domain names in certs. Section 7.4 - s/ayntax/syntax/ - I would add a notice that the username part is case-sensitive and = should not be normalised, which is not the case with domains in the SIP = uri. A not about internationalised domain names would also be good for = implementers since you mention international environments (even though = there=E2=80=99s a reference already, but helping implementors is always = a good thing). Section 11: - =E2=80=9CSimilar practices could be used to support opportunistic signing of SIP requests for UA-integrated authentications services with self-signed certificates, though that is outside the scope of this specification and is left as a matter for future = investigation.=E2=80=9D s/authentications/authentication/ - The first reference to RFC3325 seems to lack a link in the HTML = version: =E2=80=9C[RFC3325] defines the "id" priv-value token, which is = specific to the P-Asserted-Identity header.=E2=80=9D Section 12.4: - In a scenario with Outbound Edge proxies - would the requirement of a = direct TLS connection in 12.4 require that the authentication service is = placed on the edge proxies? I would say it is natural to place it in the = registrar/auth service beyond the edge proxies, but then this = requirement fails. SIP Outbound is an update to RFC 3261 and can not be ignored in this work in my opinion. Section 12.5 - The first paragraph claims it is RECOMMENDED to employ strong = authentication practises. Section 5 claims it is a MUST. Some general comments - I think the document would benefit from a few definitions of terms = used in the beginning, as it suffers from a chicken and egg problem. A = lot of terms is used before they are explained. - It is unclear how identity headers should be handled by a b2bua, = especially when media keying is included in the signature=E2=80=A6 That = may be for discussion somewhere else, but is something I expect will = come up. b2bua=E2=80=99s may be able to forward Identity headers but = typically wants to anchor media streams. It is has been discussed that = discussion is not documented in the document. I don=E2=80=99t believe = this work can ignore the existence of B2Bua=E2=80=99s, nor hand the = problem over to another wg (like straw) to solve. - Can we do this without referring to the SIPS: uri scheme? I am not = happy seeing this uri scheme turn up in new documents. /Olle _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir From nobody Mon Jul 18 18:16:32 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3464E12DBBB for ; Mon, 18 Jul 2016 18:16:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.011 X-Spam-Level: X-Spam-Status: No, score=-1.011 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_NEUTRAL=0.779, T_DKIM_INVALID=0.01] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=neutral reason="invalid (public key: not available)" header.d=standardstrack.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hz91-9UMAgVz for ; Mon, 18 Jul 2016 18:16:27 -0700 (PDT) Received: from biz104.inmotionhosting.com (biz104.inmotionhosting.com [173.247.247.235]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7536912DB2D for ; Mon, 18 Jul 2016 18:16:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=standardstrack.com; s=default; h=To:References:Message-Id:Date:In-Reply-To: From:Subject:Mime-Version:Content-Type; bh=JssJ+T9vQA8YrHSd1ey8sPwWGf72EeG24tA3bumvEyI=; b=h9WVijUxLooh7PO0qX+Nr8gCVw 7HKRGosH24Ovk6pGaljE/V8ruoSzbQlhQJlknLd9e1PvB1irQUnLrnsyvvwiSGNpiYiIRRb5Lvq80 uSPYO8rKjWqjs4AsBDulGoaSKhEm+YlapEzJalyMgPEk2NGqRgEkaGA4BPA4hQEzO1aw=; Received: from ip68-100-196-239.dc.dc.cox.net ([68.100.196.239]:52387 helo=[192.168.15.107]) by biz104.inmotionhosting.com with esmtpsa (TLSv1:DHE-RSA-AES256-SHA:256) (Exim 4.86_1) (envelope-from ) id 1bPJe1-0001UZ-S3 for stir@ietf.org; Mon, 18 Jul 2016 18:16:26 -0700 Content-Type: multipart/signed; boundary="Apple-Mail=_ACC8C9E6-6260-4CF9-83D5-A9DA6F728074"; protocol="application/pgp-signature"; micalg=pgp-sha256 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) X-Pgp-Agent: GPGMail From: Eric Burger In-Reply-To: Date: Mon, 18 Jul 2016 21:16:20 -0400 Message-Id: <0C0703AE-CD3F-456A-A482-89DCC45BF7D3@standardstrack.com> References: <7594FB04B1934943A5C02806D1A2204B476855E5@ESESSMB208.ericsson.se> <2EF2D1DC-A510-42A8-BAA9-C2058F9EA782@neustar.biz> <96FA6E44-83FF-41B1-A8C3-63620B813937@chriswendt.net> To: IETF STIR Mail List X-Mailer: Apple Mail (2.3124) X-OutGoing-Spam-Status: No, score=-2.9 X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - biz104.inmotionhosting.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - standardstrack.com X-Get-Message-Sender-Via: biz104.inmotionhosting.com: authenticated_id: eburger+standardstrack.com/only user confirmed/virtual account not confirmed X-Authenticated-Sender: biz104.inmotionhosting.com: eburger@standardstrack.com X-Source: X-Source-Args: X-Source-Dir: Archived-At: Subject: Re: [stir] a syntax change X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Jul 2016 01:16:31 -0000 --Apple-Mail=_ACC8C9E6-6260-4CF9-83D5-A9DA6F728074 Content-Type: multipart/alternative; boundary="Apple-Mail=_7D8C8A73-6361-42DD-97F6-2FF73B242C2F" --Apple-Mail=_7D8C8A73-6361-42DD-97F6-2FF73B242C2F Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=windows-1252 I agree with Jon. There is only so much we can do to support MITM = attacks. At a certain point, if something hacks SIP to the point the = signaling is unintelligible, the signaling is unintelligible. > On Jul 14, 2016, at 5:24 PM, Peterson, Jon = wrote: >=20 >=20 > Well, many of the same B2BUAs that today alter the Date header surely = strip the Identity header as well, as they strip virtually any header = that is not specifically authorized. There is a certain amount we can = and should do to accommodate such devices, but its a two-way street - = reconfiguring such devices to accept Identity while still munging Date = might be counterproductive. >=20 > That much said, yes, rfc4474bis-10 certainly allows sending "canon" = without first receiving a 438. Maybe the answer is a deployment profile, = as you suggest, for environments where it is known to be a problem. If = that turns out to be "all meaningful environments" well... then in time = we migrate the base standard in that direction. The point is, if it = turned out that we always needed "canon," then we should design the = header in such a way that "canon" isn't even a parameter, and just carry = the raw PASSporT object. We should avoid options where we don't think = they're useful, especially when it comes to security mechanisms. But = until we're sure it isn't useful, I think the guidance we have now is = what we should stick with. >=20 > Jon Peterson > Neustar, Inc. >=20 > From: Chris Wendt > > Date: Monday, July 11, 2016 at 5:50 PM > To: Jon Peterson > > Cc: Christer Holmberg >, IETF STIR Mail List = > > Subject: Re: [stir] a syntax change >=20 >> Relevant to this topic, I think one other valid discussion point that = we may or may not have talked about on the list or face to face is how = often we think the date header will be changed in transit. >>=20 >> The current rule is if signature verification fails a 438 is sent = back and the authentication service should sent the INVITE with an = identity header with canon parameter and the full token with the date = explicitly included. >>=20 >> If we believe the date header will be changed often, then we = obviously don=92t want a high percentage of SIP calls creating 438 = errors to force new INVITES (or effectively sending INVITEs twice) >>=20 >> Perhaps, for some real-world applications there is a low chance of a = date header change because the call path is fairly predictable, and the = cases where a 438 happens is very rare. Then favoring the current = default is correct. >>=20 >> But, for example, in situation where many B2BUAs are part of the = application, you may have a very decent chance that someone is going to = change a date header out of your control, we may want canon because = sending the invite twice is more expensive than saving the header and = claims bytes in the first place. >>=20 >> One approach is rely on industry SIP profile documents to define such = things to send =93canon=94 for every call. I don=92t think anything in = 4474bis prevents that, correct me if I=92m wrong Jon. >>=20 >> The question I think would be good to get more input on is if date = header changes are more common or rare in most peoples operational = experience. >>=20 >> Thanks. >>=20 >> -Chris >>=20 >>> On Jul 11, 2016, at 7:29 AM, Peterson, Jon > wrote: >>>=20 >>>=20 >>> I don't think we took a formal consensus call, or what have you. = What we did do though is to include in rfc4474bis a URI normalization = procedure that we hope will obviate the ambiguity about URI comparisons = you raised. >>>=20 >>> I still think the message size reduction is worth the complexity = trade-off to permit "canon" not to be included - and if it is allowed to = be absent at all, then I think by default it should be absent. >>>=20 >>> Jon Peterson >>> Neustar, Inc. >>>=20 >>> Sent from my iPad >>>=20 >>> On Jul 11, 2016, at 9:13 AM, Christer Holmberg = > = wrote: >>>=20 >>>> Hi, >>>>=20 >>>> Some time ago there was a discussion whether we should include the = claims to begin with, as the information can be retrieved from other SIP = information elements. >>>>=20 >>>> Did we make a conclusion on that? >>>>=20 >>>> Regards, >>>>=20 >>>> Christer >>>> =A0 <> >>>> From: stir [mailto:stir-bounces@ietf.org = ] On Behalf Of Peterson, Jon >>>> Sent: 09 July 2016 02:17 >>>> To: IETF STIR Mail List > >>>> Subject: [stir] a syntax change >>>>=20 >>>>=20 >>>> Attentive readers will observed a syntax change in passport-04 = which carries over to rfc4744bis-10. Implementers, especially those = looking forward to the SIPit coming up, should take note. >>>>=20 >>>> The change is to the claims of the PASSporT object. Rather than = having two different versions of each claim to reflect the originating = and destination side, such as "otn" and "dtn", there is now simply a = "tn" claim. That claim will appear within a JSON array explicitly = labeled as "orig" or "dest" in the PASSporT object. >>>>=20 >>>> This will result in PASSporT claims like the following: >>>>=20 >>>> { "orig":{"tn":"12155551212"}, >>>> "dest":{"tn":"12155551213"}, >>>> "iat":"1443208345" } >>>>=20 >>>> The "dest" claim is specifically defined to allow one or more = values, so it replaces the previous "dgrp" claim to be used in cases = where a message has multiple destinations. >>>>=20 >>>> This eliminated the redundancy of having future extensions to the = PASSporT claims identify whether they carried an identifier for the = originating or destination side. Now, new claim definitions simply have = to state that they contain identifiers: the semantics of the identifier = will depend on whether it appears under "orig" or "dest". In fact, = PASSporT could probably work with some existing JWT claims now that = represent identifiers. This seemed like a much better idea than the way = we were doing it before. >>>>=20 >>>> This was a fairly last-minute fix, but it didn't require much spec = change and is hopefully stable and consistent. Thoughts welcome. >>>>=20 >>>> Jon Peterson >>>> Neustar, Inc. >>>>=20 >>>>=20 >>> _______________________________________________ >>> stir mailing list >>> stir@ietf.org >>> https://www.ietf.org/mailman/listinfo/stir = > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir --Apple-Mail=_7D8C8A73-6361-42DD-97F6-2FF73B242C2F Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=windows-1252 I agree with Jon. There is only so much we can do to support = MITM attacks. At a certain point, if something hacks SIP to the point = the signaling is unintelligible, the signaling is unintelligible.

On Jul 14, 2016, at 5:24 PM, Peterson, Jon <jon.peterson@neustar.biz> wrote:


Well, many of the same B2BUAs that today alter the Date = header surely strip the Identity header as well, as they strip virtually = any header that is not specifically authorized. There is a certain = amount we can and should do to accommodate such devices, but its a two-way street - reconfiguring such devices to accept = Identity while still munging Date might be counterproductive.

That much said, yes, rfc4474bis-10 certainly allows = sending "canon" without first receiving a 438. Maybe the answer is a = deployment profile, as you suggest, for environments where it is known = to be a problem. If that turns out to be "all meaningful environments" well... then in time we migrate the base standard in that direction. = The point is, if it turned out that we always needed "canon," then we = should design the header in such a way that "canon" isn't even a = parameter, and just carry the raw PASSporT object. We should avoid options where we don't think they're useful, especially = when it comes to security mechanisms. But until we're sure it isn't = useful, I think the guidance we have now is what we should stick = with.

Jon Peterson
Neustar, Inc.

From: Chris Wendt = <chris-ietf@chriswendt.net>
Date: Monday, July = 11, 2016 at 5:50 PM
To: Jon Peterson = <jon.peterson@neustar.biz>
Cc: Christer Holmberg = <christer.holmberg@ericsson.com>, IETF STIR Mail List = <stir@ietf.org>
Subject: Re: [stir] a = syntax change

Relevant to this topic, I think one other valid discussion point that we = may or may not have talked about on the list or face to face is how = often we think the date header will be changed in transit.

The current rule is if signature verification fails a = 438 is sent back and the authentication service should sent the INVITE = with an identity header with canon parameter and the full token with the = date explicitly included.

If we believe the date header will be changed often, = then we obviously don=92t want a high percentage of SIP calls creating = 438 errors to force new INVITES (or effectively sending INVITEs = twice)

Perhaps, for some real-world applications there is a low = chance of a date header change because the call path is fairly = predictable, and the cases where a 438 happens is very rare.  Then = favoring the current default is correct.  

But, for example, in situation where many B2BUAs are = part of the application, you may have a very decent chance that someone = is going to change a date header out of your control, we may want canon = because sending the invite twice is more expensive than saving the header and claims bytes in the first place.

One approach is rely on industry SIP profile documents = to define such things to send =93canon=94 for every call.  I don=92t = think anything in 4474bis prevents that, correct me if I=92m wrong = Jon.

The question I think would be good to get more input on = is if date header changes are more common or rare in most peoples = operational experience. 

Thanks.

-Chris

On Jul 11, 2016, at 7:29 AM, Peterson, Jon <jon.peterson@neustar.biz> wrote:


I don't think we took a formal consensus call, or what have you. What we = did do though is to include in rfc4474bis a URI normalization procedure = that we hope will obviate the ambiguity about URI comparisons you = raised. 

I still think the message size reduction is worth the complexity = trade-off to permit "canon" not to be included - and if it is allowed to = be absent at all, then I think by default it should be = absent. 

Jon Peterson
Neustar, Inc.

Sent from my iPad

On Jul 11, 2016, at 9:13 AM, Christer Holmberg <christer.holmberg@ericsson.com> wrote:

Hi,
 
Some time ago there was a discussion = whether we should include the claims to begin with, as the information = can be retrieved from other SIP information elements.
 
Did we make a conclusion on that?
 
Regards,
 
Christer
 
From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Peterson,= Jon
Sent: 09 July 2016 02:17
To: IETF STIR Mail List <stir@ietf.org>
Subject: [stir] a syntax change
 
 
Attentive readers will observed a syntax change in = passport-04 which carries over to rfc4744bis-10. Implementers, = especially those looking forward to the SIPit coming up, should take note.
 
The change is to the claims of the PASSporT object. Rather = than having two different versions of each claim to reflect the = originating and destination side, such as "otn" and "dtn", there is now simply a "tn" claim. That claim will appear within a JSON = array explicitly labeled as "orig" or "dest" in the PASSporT = object. 
 
This will result in PASSporT claims like the following:
 
      { =
"orig":{"tn":"12155551212"},
        =
"dest":{"tn":"12155551213"},
        "iat":"1443208345" =
}
 
The "dest" claim is specifically defined to allow one or more = values, so it replaces the previous "dgrp" claim to be used in cases = where a message has multiple destinations.
 
This eliminated the redundancy of having future extensions to = the PASSporT claims identify whether they carried an identifier for the = originating or destination side. Now, new claim definitions simply have to state that they contain identifiers: the = semantics of the identifier will depend on whether it appears under = "orig" or "dest". In fact, PASSporT could probably work with some = existing JWT claims now that represent identifiers. This seemed like a much better idea than the way we were doing it = before.
 
This was a fairly last-minute fix, but it didn't require much = spec change and is hopefully stable and consistent. Thoughts = welcome.
 
Jon Peterson
Neustar, Inc.
 
 
_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir
_______________________________________________
stir = mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir

= --Apple-Mail=_7D8C8A73-6361-42DD-97F6-2FF73B242C2F-- --Apple-Mail=_ACC8C9E6-6260-4CF9-83D5-A9DA6F728074 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQIcBAEBCAAGBQJXjX9kAAoJEORoZaSQsc1Ij9YP/R/ehGb88DuZOADA6mPLf17/ CzglG6GvSKPECFDlZ/wJzQW2D2VH/HIiTSRjLWmpvl0nzQmYdrftoX8cwYtJwThN 8HYe611/3bTTFD/UGNC0acfIgyMbjprCTM80DthI9QgJ6DF7Entn10E3tqNap743 IS0JaJbOqlh9PS1sCVPzYcKzpqEVU/SZrX7LXv+epxWTBhaMb7NkyOezy4yr4ekK 3/EokODbupywIFVEXfhpOqMXUqI2WUWoEk7LIyr6lV6x7xsAUO1m/7Z3ZoOfNdn2 suPGZqxgWBd5eblOWh+wwZUP/IEnmeaDIXukM5rmntQAlqCf6pfLYhZCrNB/E1iW I2DD3+WW/Ve7wtRwAMQYemAI2+t9aCnAfATeCAguaJoZf/oPphOh1cjr9FJjerOi sKcLKVj4Bf1Z6+r1CD+zRzfSZaSWonvrIJMhR2/ENubcRqO248D9i0rt03yPvgNv AV01lUhmZ4cUa0mtm5CHdpvfmHZrYN5V+/4IFTq1Z0PrwTn7xWo8kWagks4zjUm8 4+SCtgWifGJQehcHNDm8H95G4g+18XsuEfNHIDU7cOmflNefnDrPnRHuJxM0wZqI TD5p1SchzsflfvyBNcctrnCMlygcjWrg14+Fa7E9FYVcFB6mI3pR+HJSyBYgekaB zBSg09yU60WoDue1AEwH =ZZdG -----END PGP SIGNATURE----- --Apple-Mail=_ACC8C9E6-6260-4CF9-83D5-A9DA6F728074-- From nobody Wed Jul 20 04:28:35 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 68D0912DB9C for ; Wed, 20 Jul 2016 04:28:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.187 X-Spam-Level: X-Spam-Status: No, score=-3.187 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-1.287] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gpgtcpE8JNVl for ; Wed, 20 Jul 2016 04:28:31 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CA64412B05F for ; Wed, 20 Jul 2016 04:28:31 -0700 (PDT) Received: from dhcp-b103.meeting.ietf.org (dhcp-b103.meeting.ietf.org [31.133.177.3]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id u6KBSTMn063527 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=OK) for ; Wed, 20 Jul 2016 06:28:30 -0500 (CDT) (envelope-from rjsparks@nostrum.com) To: stir@ietf.org From: Robert Sparks Message-ID: Date: Wed, 20 Jul 2016 13:28:27 +0200 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: [stir] Draft minutes STIR@IETF96 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Jul 2016 11:28:33 -0000 The first draft of minutes are here: https://www.ietf.org/proceedings/96/minutes/minutes-96-stir Please send any corrections to the list or the chairs as soon as you spot them. Thanks again to Mary for capturing the detailed notes. RjS From nobody Fri Jul 22 03:09:49 2016 Return-Path: X-Original-To: stir@ietf.org Delivered-To: stir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 7AB0812DF62; Fri, 22 Jul 2016 03:09:40 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.29.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20160722100940.12264.13821.idtracker@ietfa.amsl.com> Date: Fri, 22 Jul 2016 03:09:40 -0700 Archived-At: Cc: stir@ietf.org Subject: [stir] I-D Action: draft-ietf-stir-passport-05.txt X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Jul 2016 10:09:40 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Secure Telephone Identity Revisited of the IETF. Title : Persona Assertion Token Authors : Chris Wendt Jon Peterson Filename : draft-ietf-stir-passport-05.txt Pages : 17 Date : 2016-07-22 Abstract: This document defines a token format for verifying with non- repudiation the sender of and authorization to send information related to the originator of personal communications. A cryptographic signature is defined to protect the integrity of the information used to identify the originator of a personal communications session (e.g. the telephone number or URI) and verify the accuracy of this information at the destination. The cryptographic signature is defined with the intention that it can confidently verify the originating persona even when the signature is sent to the destination party over an unsecure channel. The Persona Assertion Token (PASSporT) is particularly useful for many personal communications applications over IP networks and other multi-hop interconnection scenarios where the originating and destination parties may not have a direct trusted relationship. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-stir-passport/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-stir-passport-05 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-stir-passport-05 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Fri Jul 22 03:11:44 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5F1A512DF67 for ; Fri, 22 Jul 2016 03:11:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.829 X-Spam-Level: X-Spam-Status: No, score=-1.829 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_SORBS_WEB=0.77] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=chriswendt-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Mm6Mpn4OQ1Pn for ; Fri, 22 Jul 2016 03:11:40 -0700 (PDT) Received: from mail-wm0-x235.google.com (mail-wm0-x235.google.com [IPv6:2a00:1450:400c:c09::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D1C6512DF75 for ; Fri, 22 Jul 2016 03:11:39 -0700 (PDT) Received: by mail-wm0-x235.google.com with SMTP id p129so7618805wmp.0 for ; Fri, 22 Jul 2016 03:11:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chriswendt-net.20150623.gappssmtp.com; s=20150623; h=from:subject:date:references:to:message-id:mime-version; bh=h7yLrqPAyFeWsGGcyF7oimXtEJJeoqFk7P2wRYq+d7U=; b=IpzTDi4lsVmZGFp3P0DQW6CzEQ7yOIG6e4GptMYb+gFYf6CyoQ4cWm8uoSuKMM9q3v AUZFM3Xo+KzKzLoYQ6i/UF4G/P9qeRx7ceHFKm8vsEMPV6QSGlcZYMI18Cm1GKrj0ZJy ehBiPKzRfNko2g1NIN6teiGfRb5BwYLMBRKYAFs9eHA6U1E7C0xJB92gqFcNZr5SQFeo r3auE3Swc0aYL0KeJi9WrGvYEFIAbwCKm8eCiHrWP1+eLF+4hWvc69MUARm2oZanipWt NAx+c2GArep3mshcUvBu+8ub01r2wXOaZp2FLaYQhq4vCAyBxAgRqgc4uN7u5vtOiGv9 uizQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:subject:date:references:to:message-id :mime-version; bh=h7yLrqPAyFeWsGGcyF7oimXtEJJeoqFk7P2wRYq+d7U=; b=AsU7viw+yJgNNTQfPrPRIDCUZZQlYVM3oRARHEjzhimU3aaQxg0/ogk7zos90t9yIc /nw6b1od0zSQPYG7CsdpI/La1St/CXpOxvX2RV3au8cHk8weMFZ54H+lJ+bTMkQ7I0v5 E6Ab86oD8vy89+lWVRiAKFT7a+Q7ET8V8lwcc+Q16qk/MjLZNocIXoEptq0Z5xfWfMWt N6KJ756lwkNSQwlPB2D+EdLY64Hh8JD2V/ms2J4AvPfss7PDRUMWf6RHXg6D2Jh/CmPD 2Xicob9iidXiJ0+Oav+7/Zbt2hY8CfiTJNiuTAPqFFxm4FTrdel1t3vSKluStsoHcs7+ H30A== X-Gm-Message-State: AEkoousuasR99w6vtI/UVz77erBBolX2a0eMIgIcHyvSpfEO67eJw3pWxB/Aib442PZiug== X-Received: by 10.28.37.2 with SMTP id l2mr4445875wml.23.1469182298014; Fri, 22 Jul 2016 03:11:38 -0700 (PDT) Received: from [172.20.0.134] ([62.217.47.18]) by smtp.gmail.com with ESMTPSA id za2sm161333wjb.34.2016.07.22.03.11.37 for (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Fri, 22 Jul 2016 03:11:37 -0700 (PDT) From: Chris Wendt Content-Type: multipart/alternative; boundary="Apple-Mail=_7F5D6F2B-D29D-497B-84FA-F3B5F85267B2" Date: Fri, 22 Jul 2016 12:11:36 +0200 References: <20160722100940.12264.80711.idtracker@ietfa.amsl.com> To: IETF STIR Mail List Message-Id: <1184BC28-D61B-423C-A75F-A7077773FA71@chriswendt.net> Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) X-Mailer: Apple Mail (2.3124) Archived-At: Subject: [stir] Fwd: New Version Notification for draft-ietf-stir-passport-05.txt X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Jul 2016 10:11:42 -0000 --Apple-Mail=_7F5D6F2B-D29D-497B-84FA-F3B5F85267B2 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Hi All, I made quick updates to the draft based on discussions and promised = updates. I also received suggested text from Ted about unicode character handling = and incorporated in new draft. (Thanks Ted!) Please have a look. -Chris > Begin forwarded message: >=20 > From: internet-drafts@ietf.org > Subject: New Version Notification for draft-ietf-stir-passport-05.txt > Date: July 22, 2016 at 12:09:40 PM GMT+2 > To: "Jon Peterson" , "Chris Wendt" = >=20 >=20 > A new version of I-D, draft-ietf-stir-passport-05.txt > has been successfully submitted by Chris Wendt and posted to the > IETF repository. >=20 > Name: draft-ietf-stir-passport > Revision: 05 > Title: Persona Assertion Token > Document date: 2016-07-22 > Group: stir > Pages: 17 > URL: = https://www.ietf.org/internet-drafts/draft-ietf-stir-passport-05.txt > Status: = https://datatracker.ietf.org/doc/draft-ietf-stir-passport/ > Htmlized: = https://tools.ietf.org/html/draft-ietf-stir-passport-05 > Diff: = https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-stir-passport-05 >=20 > Abstract: > This document defines a token format for verifying with non- > repudiation the sender of and authorization to send information > related to the originator of personal communications. A > cryptographic signature is defined to protect the integrity of the > information used to identify the originator of a personal > communications session (e.g. the telephone number or URI) and verify > the accuracy of this information at the destination. The > cryptographic signature is defined with the intention that it can > confidently verify the originating persona even when the signature = is > sent to the destination party over an unsecure channel. The Persona > Assertion Token (PASSporT) is particularly useful for many personal > communications applications over IP networks and other multi-hop > interconnection scenarios where the originating and destination > parties may not have a direct trusted relationship. >=20 >=20 >=20 >=20 > Please note that it may take a couple of minutes from the time of = submission > until the htmlized version and diff are available at tools.ietf.org. >=20 > The IETF Secretariat >=20 --Apple-Mail=_7F5D6F2B-D29D-497B-84FA-F3B5F85267B2 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Hi All,

I = made quick updates to the draft based on discussions and promised = updates.

I = also received suggested text from Ted about unicode character handling = and incorporated in new draft. (Thanks Ted!)

Please have a look.

-Chris

Begin forwarded message:

From: = internet-drafts@ietf.org
Subject: = New Version = Notification for draft-ietf-stir-passport-05.txt
Date: = July 22, 2016 at 12:09:40 PM = GMT+2
To: = "Jon Peterson" <jon.peterson@neustar.biz>, "Chris Wendt" <chris-ietf@chriswendt.net>

A new version of I-D, draft-ietf-stir-passport-05.txt
has been successfully submitted by Chris Wendt and posted to = the
IETF repository.

Name: = draft-ietf-stir-passport
Revision: 05
Title:= = Persona Assertion Token
Document date: = 2016-07-22
Group: stir
Pages: 17
URL: =            https://www.ietf.org/internet-drafts/draft-ietf-stir-passport-0= 5.txt
Status: =         https://datatracker.ietf.org/doc/draft-ietf-stir-passport/<= br class=3D"">Htmlized:       https://tools.ietf.org/html/draft-ietf-stir-passport-05
Diff: =           https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-stir-passport-05=

Abstract:
=   This document defines a token format for verifying with = non-
  repudiation the sender of and = authorization to send information
  related to = the originator of personal communications.  A
=   cryptographic signature is defined to protect the integrity = of the
  information used to identify the = originator of a personal
  communications = session (e.g. the telephone number or URI) and verify
=   the accuracy of this information at the destination. =  The
  cryptographic signature is defined = with the intention that it can
  confidently = verify the originating persona even when the signature is
=   sent to the destination party over an unsecure channel. =  The Persona
  Assertion Token (PASSporT) = is particularly useful for many personal
=   communications applications over IP networks and other = multi-hop
  interconnection scenarios where the = originating and destination
  parties may not = have a direct trusted relationship.




Please note that it may take a = couple of minutes from the time of submission
until the = htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat


= --Apple-Mail=_7F5D6F2B-D29D-497B-84FA-F3B5F85267B2-- From nobody Fri Jul 22 09:29:23 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2844112D691 for ; Fri, 22 Jul 2016 09:29:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.487 X-Spam-Level: X-Spam-Status: No, score=-5.487 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-1.287, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=fccoffice.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Hc_429aHggNi for ; Fri, 22 Jul 2016 09:29:15 -0700 (PDT) Received: from DC-IP-2.fcc.gov (dc-ip-2.fcc.gov [192.104.54.91]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 49A0D12DE11 for ; Fri, 22 Jul 2016 09:29:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fccoffice.onmicrosoft.com; s=selector1-fcc-gov; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=GkhJV2w6ZLzlW0XhfSScP6/SYbplbtjejQueXjP6j0k=; b=r1tYQ1FnKGZeGnnXKaTFSdvcBV56co7XPLiWeSyObOWkfOeU9QWmEMQNkVrHgcqO7OWqJC9ZTxDMgAAvdLxxSqr16QnzoQ6V8PArH/SZGLR0INPqUE4ZE5dJHtSKjXyTLqEJoz8tCyIMnngmXDH7wIYhaHkddFAqXHEd8ttqSAA= From: Henning Schulzrinne To: "stir@ietf.org" Thread-Topic: Blog post by Chairman Wheeler, FCC Thread-Index: AQHR5DYsOKPbCE0+40O+vo9ipPg+6g== Date: Fri, 22 Jul 2016 16:29:09 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Henning.Schulzrinne@fcc.gov; x-ms-office365-filtering-correlation-id: a4d4493b-18a2-4621-36a0-08d3b24d4ef0 x-microsoft-exchange-diagnostics: 1; CY1PR09MB0633; 6:JlWVOQ9tzoj43bw2H6XPst+BD0Uzfo/SvTX8Xmu2cLiI0Ad9JQRZFJkzgGarJ4wMU8sNYL46Tr5JUZ1Se8yOlff4WWG8gqe7RReIau0yCdcBkA5yTKoDbq1Sz4SV2g+8Zcp5xv552jh/ioDIpGL5o5w8LeA5yneeO2YlJATwqoV5nLIMBKw1LexDF+Erk5H7A4AI/iaaPOPIkNfZa0AzAa0MKOV/lWo094QnHd/hId6PCPunJaMSTdQ+r6Tp0W3lUzAgCtLg7B7h/sVacwUvxaboTI0HjW0LcQk/6g53bSI=; 5:ShYQE+qhneUKBAOntgDva8IOW/1tJ9PEz77oJf4JMxSuRKujSGT5elaEEW4f6jXcUvTlhWerspluFdDzw1c8OKq9xd3LIpTcP0ZLdWyMABlQ843V5bLCQJljbeszUjnGuwIxZYWkLUZuWQ9FRfK5cQ==; 24:fv75/k2KPrNJZtDICP92PZy34Eul4DbVURZ92QvhWCPkLgyw7jR3rma6gL/Yd7sSGm0QjCxTQLeiQmmw+a7TOLABZip5xuX/tApp1UHqkX0=; 7:uOk/6wkU/NfcQwHkFCA2NqTYOJd80YD0lGuWuGHNuXfLUra6hrfqNBaDIGg6VtE2e6ogYWrGPCo1jQQc9sCzcI7sEg53UiNSWbUoekR0L0BSWk+bK7F9prShMbRuUoRlmPYoLICkHe1DXDmWQO0U3NWrX7SGiOU4+bn2MIeWzqOLmki6Ti3eDAwuBJOq2mQu6VrMvP3ffx8pAD2o2G9civLRB+UBg3FPokvLElvbFcFmwQJBjp8yV8TpS60eoE2M x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:CY1PR09MB0633; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:; x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(601004)(2401047)(8121501046)(5005006)(10201501046)(3002001); SRVR:CY1PR09MB0633; BCL:0; PCL:0; RULEID:; SRVR:CY1PR09MB0633; x-forefront-prvs: 0011612A55 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(7916002)(199003)(189002)(54356999)(7906003)(19627405001)(81156014)(3660700001)(2351001)(7846002)(3280700002)(110136002)(122556002)(229853001)(7736002)(8936002)(7696003)(5640700001)(5003600100003)(19580395003)(586003)(81166006)(2501003)(1730700003)(6116002)(102836003)(2906002)(92566002)(10400500002)(5002640100001)(19617315012)(558084003)(19625215002)(33656002)(9686002)(105586002)(107886002)(87936001)(74316002)(86362001)(16236675004)(50986999)(76576001)(106116001)(189998001)(99286002)(450100001)(11100500001)(15975445007)(77096005)(8676002)(106356001)(2900100001)(68736007)(101416001)(97736004)(3826002); DIR:OUT; SFP:1102; SCL:1; SRVR:CY1PR09MB0633; H:CY1PR09MB0634.namprd09.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: fcc.gov does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY1PR09MB06342317A7064026CDB86922EA0A0CY1PR09MB0634namp_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Jul 2016 16:29:09.2210 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72970aed-3669-4ca8-b960-dd016bc72973 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR09MB0633 X-OriginatorOrg: fcc.gov Archived-At: Subject: [stir] Blog post by Chairman Wheeler, FCC X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Jul 2016 16:29:18 -0000 --_000_CY1PR09MB06342317A7064026CDB86922EA0A0CY1PR09MB0634namp_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable https://www.fcc.gov/news-events/blog/2016/07/22/cutting-robocalls Cutting off Robocalls www.fcc.gov Robocalls and telemarketing calls are currently the number one source of co= nsumer complaints at t --_000_CY1PR09MB06342317A7064026CDB86922EA0A0CY1PR09MB0634namp_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

https://www.fcc.gov/news-even= ts/blog/2016/07/22/cutting-robocalls

www.fcc.gov
Robocalls and telemarketing calls are currently the number one source of co= nsumer complaints at t


--_000_CY1PR09MB06342317A7064026CDB86922EA0A0CY1PR09MB0634namp_-- From nobody Thu Jul 28 10:37:35 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E460612D093 for ; Thu, 28 Jul 2016 10:37:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.107 X-Spam-Level: X-Spam-Status: No, score=-1.107 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RDNS_NONE=0.793] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4x77zXjDd6_8 for ; Thu, 28 Jul 2016 10:37:31 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A96D112B03B for ; Thu, 28 Jul 2016 10:37:31 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u6SHcE2t023782 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT) for ; Thu, 28 Jul 2016 10:38:15 -0700 From: Dave Crocker Organization: Brandenburg InternetWorking To: "stir@ietf.org" Message-ID: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> Date: Thu, 28 Jul 2016 10:37:25 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: [stir] Review of: draft-ietf-stir-passport-05 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Jul 2016 17:37:34 -0000 Review of: draft-ietf-stir-passport-05 Date: 27 July 2016 Revied by: D. Crocker Summary: The 'Persona Assertion Token' specification defines an object containing multiple attributes that are intended to be used for authentication, integrity and non-repudiation, such as validating the originator of a SIP telephone call. The object is intended to be application- and transport-independent. In effect, the object links certification details to application details and/or transport details. Although the text provides details of 'how' to compose a passport token, it never actually says what passport is. There are some later comments that imply what it is, or seem to assume a knowledge of what it is, but it's never defined as a technical construct. By way of example, how does it differ from the function of an X.509 cert? The specification has problems with its explanation of purpose and its apparent scope, as well as occasional lack of clarity or correctness. It even has quite a few typographical errors that would have been trivially detected by a spelling corrector. The document was only first produced in February, with 4 revisions in the last 3 months, including one during Last Call. And the recent revisions have included quite substantive changes. Discussion about the draft on the wg mailing list has been thin. Also, during the wg session in Berlin, discussion seemed to include a fair amount of reference to what 'might' be done -- eg, tailoring use through profiles or encoding for SIP or... -- rather than clarity about how this specification would definitely be used. It suggests the possibility of less stability in community understanding of the specification than one would wish for an IETF proposed standard. The document is /not/ ready for publication. This appears to be a specification for something that is for far more general use than simply doing caller-id authentication; as such it appears to go beyond the scope of the working group's charter. This might be acceptable, if the solution provided adequately covered what /is/ in scope and were still timely and sufficiently 'efficient'. However the working group has taken 3 years to produce this work and there are no other use-cases presented and no other specifications for use, to justify the purported generality. As such, the generality is purely theoretical. Worse, there is a poor track-record of such efforts proving successful at being more general. Instead, they impose the overhead of generality without the benefit. The document is written with the apparent expectation that the reader has quite a bit of prior knowledge but it isn't stated explicitly. This needs to be written for a wider audience than just those already in the wg and more than those already familiar with the work. If there are specific details the reader must know ahead of time, state or cite them early and explicitly As an example, the document is really built on top of JWT but doesn't introduce the reference or details about this until section 3. (The passing reference in section 2 does not explain that JWT is foundational to the current work.) As to the choice of JWT, it seems odd, since it isn't natural to the SIP context, which is essential for the chartered work, and therefore requires an additional layer of translation for use with SIP. The document title and the content use the term 'persona' but there is nothing in this document that pertains to any of the normal, technical -- or even informal -- uses of the term. So it might be a clever turn of phrase, but it appears to be significantly inappropriate, or at least misleading. (Perhaps the goal is to sustain the unusual choices that SIP made, such as with the term 'identity', deviating from usages in the world of online identity?...) The document desperately needs a carefully-written terminology section. The specification is dominated by heavy focus on the details and mechanisms, without much that covers purposes and functions. The text is heavy with redundant acronyms usage, to the point of distraction. (Imagine specifying http by having every paragraph say that ASCII (or Unicode or whatever) is being used. Assert packaging-related details only where needed, rather than feeling that every bit of technical information must be seasoned with references to JWT, JWS, or whatever. Algorithmic details often are specified in non-linear sequence, eg, if B do C after doing A and before doing C. This makes it difficult to acquire an simple understanding of the sequence. Algorithms need to be presented in as linear a fashion as possible, and preferable include pseudo-code, to be that much more concise. In terms of pragmatics, here are two operational questions that I can't answer, based on this specification, and yet they are fundamental to the utility of this work. How is key rollover done? How is delegation done, such as for use by authorized third parties? As an example that the document needs much more careful proofreading, the terms header and headers appear to be used inconsistently and possibly incorrectly. Also I note that a revision of the draft was posted during Last Call. This can create confusion or extra work, to reconcile things. From a quick scan of the revision's diff, it doesn't appear that the changes affect this review... maybe. Also, having a Last Call that overlaps with an IETF meeting is not a good way to encourage adequate attention to the production of reviews, although the document really needed them. Detailed Comments ----------------- > STIR C. Wendt > Internet-Draft Comcast > Intended status: Standards Track J. Peterson > Expires: January 23, 2017 Neustar Inc. > July 22, 2016 > > > Persona Assertion Token > draft-ietf-stir-passport-05 > > Abstract > > This document defines a token format for verifying with non- [format] remove or remove [token] Is the timestamp the basis of claiming non-repudiation? > repudiation the sender of and authorization to send information > related to the originator of personal communications. A 'info related to'... what does this mean? > cryptographic signature is defined to protect the integrity of the > information used to identify the originator of a personal > communications session (e.g. the telephone number or URI) and verify > the accuracy of this information at the destination. The 'accuracy'? validates authorship, not validity, I suspect. A signature's primary purpose usually is authenticate origination, authorship, or the like, where integrity is a side-effect of the methodology. Integrity as the primary function would typically occur only when the identity of the signer need be no more than something like 'whomever I interacted with previously'. I suspect that such a session-limited identity semantic is not, in fact, the intent here. > cryptographic signature is defined with the intention that it can > confidently verify the originating persona even when the signature is > sent to the destination party over an unsecure channel. The Persona unsecure -> insecure (unless the intend is reference to a loan?) > Assertion Token (PASSporT) is particularly useful for many personal > communications applications over IP networks and other multi-hop > interconnection scenarios where the originating and destination > parties may not have a direct trusted relationship. > > Status of This Memo > > This Internet-Draft is submitted in full conformance with the > provisions of BCP 78 and BCP 79. > > Internet-Drafts are working documents of the Internet Engineering > Task Force (IETF). Note that other groups may also distribute > working documents as Internet-Drafts. The list of current Internet- > Drafts is at http://datatracker.ietf.org/drafts/current/. > > Internet-Drafts are draft documents valid for a maximum of six months > and may be updated, replaced, or obsoleted by other documents at any > time. It is inappropriate to use Internet-Drafts as reference > material or to cite them other than as "work in progress." > > This Internet-Draft will expire on January 23, 2017. > > > > > > > > > Wendt & Peterson Expires January 23, 2017 [Page 1] > > Internet-Draft PASSporT July 2016 > > > Copyright Notice > > Copyright (c) 2016 IETF Trust and the persons identified as the > document authors. All rights reserved. > > This document is subject to BCP 78 and the IETF Trust's Legal > Provisions Relating to IETF Documents > (http://trustee.ietf.org/license-info) in effect on the date of > publication of this document. Please review these documents > carefully, as they describe your rights and restrictions with respect > to this document. Code Components extracted from this document must > include Simplified BSD License text as described in Section 4.e of > the Trust Legal Provisions and are provided without warranty as > described in the Simplified BSD License. > > Table of Contents > > 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 > 2. Token Overview . . . . . . . . . . . . . . . . . . . . . . . 4 > 3. PASSporT Definition . . . . . . . . . . . . . . . . . . . . . 4 > 3.1. PASSporT Header . . . . . . . . . . . . . . . . . . . . . 4 > 3.1.1. "typ" (Type) Header Parameter . . . . . . . . . . . . 4 > 3.1.2. "alg" (Algorithm) Header Parameter . . . . . . . . . 5 > 3.1.3. "x5u" (X.509 URL) Header Parameter . . . . . . . . . 5 > 3.2. PASSporT Payload . . . . . . . . . . . . . . . . . . . . 5 > 3.2.1. JWT defined claims . . . . . . . . . . . . . . . . . 5 > 3.2.1.1. "iat" - Issued at claim . . . . . . . . . . . . . 5 > 3.2.2. PASSporT specific claims . . . . . . . . . . . . . . 6 > 3.2.2.1. Originating and Destination Identity Claims . . . 6 > 3.2.2.2. "mky" - Media Key claim . . . . . . . . . . . . . 7 > 3.3. PASSporT Signature . . . . . . . . . . . . . . . . . . . 8 > 4. Extending PASSporT . . . . . . . . . . . . . . . . . . . . . 8 > 4.1. "ppt" (PASSporT) header parameter . . . . . . . . . . . . 8 > 4.2. Extended PASSporT Claims . . . . . . . . . . . . . . . . 9 > 5. Deterministic JSON Serialization . . . . . . . . . . . . . . 9 > 5.1. Example PASSport deterministic JSON form . . . . . . . . 10 > 6. Human Readability . . . . . . . . . . . . . . . . . . . . . . 10 > 7. Security Considerations . . . . . . . . . . . . . . . . . . . 10 > 7.1. Avoidance of replay and cut and paste attacks . . . . . . 10 > 7.2. Solution Considerations . . . . . . . . . . . . . . . . . 11 > 7.3. Privacy Considerations . . . . . . . . . . . . . . . . . 11 > 8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 11 > 8.1. Media Type Registration . . . . . . . . . . . . . . . . . 11 > 8.1.1. Media Type Registry Contents Additions Requested . . 11 > 8.2. JSON Web Token Claims Registration . . . . . . . . . . . 13 > 8.2.1. Registry Contents Additions Requested . . . . . . . . 13 > 9. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 13 > 10. References . . . . . . . . . . . . . . . . . . . . . . . . . 13 > > > > Wendt & Peterson Expires January 23, 2017 [Page 2] > > Internet-Draft PASSporT July 2016 > > > 10.1. Normative References . . . . . . . . . . . . . . . . . . 14 > 10.2. Informative References . . . . . . . . . . . . . . . . . 14 > Appendix A. Example PASSporT JWS Serialization and Signature . . 15 > A.1. X.509 Private Key Certificate for Example . . . . . . . . 16 > A.2. X.509 Public Key Certificate for Example . . . . . . . . 17 > Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 17 > > 1. Introduction > > In today's IP-enabled telecommunications world, there is a growing > concern about the ability to trust incoming invitations for > communications sessions, including video, voice and messaging. > [RFC7340] As an example, modern telephone networks provide the > ability to spoof the calling party telephone number for many > legitimate purposes including providing network features and services > on the behalf of a legitimate telephone number. However, as we have > seen, bad actors have taken advantage of this ability for > illegitimate and fraudulent purposes meant to trick telephone users > to believe they are someone they are not. This problem can be > extended to many emerging forms of personal communications. > > This document defines a common method for creating and validating a [common] delete > token that cryptographically verifies an originating identity, or > more generally a URI or application specific identity string 'identity string'? what does this mean? 'app string id'? what does this mean? > representing the originator of personal communications. Through > extended profiles other information relevant to the personal > communications can also be attached to the token. The primary goal > of PASSporT is to provide a common framework for signing persona What is a 'persona'? Where is this construct introduced or cited and explained? 'profiles'? Where is this construct introduced or cited and explained? > related information in an extensible way. A secondary goal is to It seems to also be primary. (PPT provides a framework for signing related information) ? > provide this functionality independent of any specific personal > communications signaling call logic, so that creation and > verification of persona information can be implemented in a flexible > way and can be used in many personal communications applications > including end-to-end applications that require different signaling > protocols. It is anticipated that signaling protocol specific > guidance will be provided in other related documents and > specifications to specify how to use and transport PASSporT tokens, specs to spec... awkward phrasing as always, a specification that declares what is 'anticipated' moves into purely hypothetical, which too-often proves to be wishful fantasy. The reference doesn't specify anything and it creates a dependency that well might not be satisfied. 'tokens'? Where is this constructed introduced, cited or explained? Use of a term like this implies that there is some distinctive meaning, but really there isn't. This is a format specification. That's all. If there is a claim that the term token does have significance here, then please explain it. For example, how is this token to be used? If the term is used merely as an inheritance from JWT, then cite that early, to justify the term. > however this is intentionally out of scope for this document. > > Note: As of the authoring of this document, > [I-D.ietf-stir-rfc4474bis] provides details of how to use PASSporT > within SIP signaling for the signing and verification of telephone > numbers. remove Note. Or make it a note to RFC Editor to remove it, or rephrase so it's useful 10 years from now. > > > > > > > > > Wendt & Peterson Expires January 23, 2017 [Page 3] > > Internet-Draft PASSporT July 2016 > > > 2. Token Overview > > Tokens are a convenient way of encapsulating information with Why? What are the alternatives? Why is this the starting point? > associated digital signatures. They are used in many applications Such as? Anyhow, this section seems to take the construct of 'token' as being an established term of art. It isn't. Or, at least, I've no idea what is meant here that distinguishes a token from anything else, such as other forms of encapsulation. Say/cite what a token is, if it is such a distinctive thing. Say/cite how it differs from alternatives, if its superiority is going to be touted. > that require authentication, authorization, encryption, non- > repudiation and other use cases. JSON Web Token (JWT) [RFC7519] and > JSON Web Signature (JWS) [RFC7515] are designed to provide a compact > form for many of these purposes and define a specific method and > syntax for signing a specific set of information or "claims" within > the token and therefore providing an extensible set of claims. > Additionally, JWS provides extensible mechanisms for specifying the > method and cryptographic algorithms used for the associated digital > signatures. Note that there is nothing in the above text that actually explains what a token is or how it differs from things that aren't tokens. > 3. PASSporT Definition This section is not a definition. It's more like structure, or format, or foundation or encoding. > The PASSporT is constructed based on JWT [RFC7519] and JWS [RFC7515] > specifications. JWS defines the use of JSON data structures in a > specified canonical format for signing data corresponding to JOSE > header, JWS Payload, and JWS Signature. JWT defines specific set of specific set -> a set > claims that are represented by specified key value pairs which can be > extended with custom keys for specific applications. > > 3.1. PASSporT Header > > The JWS token header is a JOSE header [RFC7515] that defines the type > and encryption algorithm used in the token. The section starts with structure detail and ends with purpose. This should be swapped. > An example of the header for the case of an ECDSA P-256 digital > signature would be the following, How is reader to know what that long string means? Is the doc only for the cognoscenti? if so, which cognoscenti? > { > "typ":"passport", > "alg":"ES256", > "x5u":"https://cert.example.org/passport.cer" > } *** EXPLAIN EXAMPLES, PLEASE *** > 3.1.1. "typ" (Type) Header Parameter > > JWS defines the "typ" (Type) Header Parameter to declare the media > type of the JWS. media type? IANA citation needed. (It was in an earlier version of the draft!) > For PASSporT Token the "typ" header MUST minimally include and begin > with "passport". This represents that the encoded token is a JWT of > type passport. Is it possible to begin with it and not include it? That is, 'include' is redundant. 'minimally' is also not information, but it raises the question: The other two attributes aren't required??? Also, this subsection is part of an Overview. Why does it have normative content? Or is this not really an overview? > > Wendt & Peterson Expires January 23, 2017 [Page 4] > > Internet-Draft PASSporT July 2016 > > > 3.1.2. "alg" (Algorithm) Header Parameter > > For PASSporT, the "alg" should be defined as follows, for the > creation and verification of PASSporT tokens and their digital > signatures ES256 MUST be implemented. > > Note that JWA [RFC7518] defines other algorithms that may be utilized > or updated in the future depending on cryptographic strength > requirements guided by current security best practice. > > 3.1.3. "x5u" (X.509 URL) Header Parameter > > As defined in JWS, the "x5u" header parameter is used to provide a > URI [RFC3986] referring to the resource for the X.509 public key > certificate or certificate chain [RFC5280] corresponding to the key So this service uses a classic X.509 authentication hierarchy? That's a key design point, only mentioned in a third-level section. > used to digitally sign the JWS. Note: The definition of what the URI > represents in terms of the actor serving the X.509 public key is out 'actor serving the X.509 public key' ? what does that mean? > of scope of this document. However, generally this would correspond > to an HTTPS or DNSSEC resource with the guidance that it MUST be a [a] remove > TLS protected, per JWS spec. This /object/ specification (that is transport independent) dictates /transport/ security??? This is probably wrong, but at least needs careful explanation. > > 3.2. PASSporT Payload > > The token payload claims should consist of the information which [payload] remove; at best it's redundant 'should'? not MUST? why? > needs to be verified at the destination party. This claim should > correspond to a JWT claim [RFC7519] and be encoded as defined by the > JWS Payload [RFC7515] should? why correspond??? what does that mean, in technical terms? > The PASSporT defines the use of a number of standard JWT defined "The PASSporT" is an affectation. Both the 'the' and the use of case. > headers as well as two new custom headers corresponding to the two header/s/? corresponding? referring? describing? identifying? addressing? > parties associated with personal communications, the originator and > terminator. These headers or key value pairs are detailed below. These headers or key value pairs are -> This information is > Key values outside the US-ASCII range should be encoded using percent > encoding as described in section 2.1 of RFC 3986, case normalized as > described in 6.2.2.1 of [RFC3986]. Matching of these values should > use string exact match. > > 3.2.1. JWT defined claims When something like this is imported from another spec, there needs to be a precise pointer to the specific part of the spec defining it. > 3.2.1.1. "iat" - Issued at claim > > The JSON claim MUST include the "iat" [RFC7519] defined claim issued > at. As defined this should be set to a date cooresponding to the issued at -> "Issued At". It would be better to explicitly cite section 4.1.6 in that RFC. Readers should not have to search an entire document to find the detail being referenced. Also, note the MUST here. I suspect this conflicts with the normative language above in the 'overview'. > origination of the personal communications. The time value should be > of the format defined in [RFC7519] Section 2 NumericDate. This is > included for securing the token against replay and cut and paste > > > > > Wendt & Peterson Expires January 23, 2017 [Page 5] > > Internet-Draft PASSporT July 2016 > > > attacks, as explained further in the security considerations in > section 7. > > 3.2.2. PASSporT specific claims > > 3.2.2.1. Originating and Destination Identity Claims > > Baseline PASSporT defines claims that convey the identity of the "Baseline PASSporT defines claims" ? First reference in a 4th-level section??? > origination and destination of personal communications. There are 'personal'? so this can't be used by and between companies? Really, there is nothing about any of this that pertains to the type of users or even the content of the communication. What is the exact definition or origination and destination? For example, there is an important distinction between the person making a call vs. the device they are using, versus the provider they are going through. Which is meant here and how is the reader to know? (cf, call for a terminology section.) > two claims that are required for PASSporT, the "orig" and "dest" > claims. Both "orig" and "dest" should have values that are JSON > objects that include identities represented by key value pairs, where 'key value pairs' aren't 'claims'? should and not must? why? > the key represents an identity type and the value is the identity > string. Currently, these identities can be represented as either So, there is expectation of other types? There needs to be a pointer to an IANA registry. > telephone numbers or Uniform Resource Indicators (URIs). The > definition of how telephone numbers or URIs and examples are provided > below. > > The "orig" JSON object MUST only have one key value pair representing > the asserted identity of any type (currently either "tn" or "uri") of > the originator of the personal communications signaling. > > The "dest" JSON object MUST have at least have one key value pair, > but could have multiple identity types (i.e. "tn" and/or "uri") but > only one of each. Additionaly, in the case of "dest" only, the > identity type key value MUST be an array signaled by standard JSON > brackets, even when there is a single identity value in the identity > type key value. > > 3.2.2.1.1. "tn" - Telephone Number identity A document that uses five-levels of section numbering warrants reconsideration of its structure. > > If the originating or destination identity is a telephone number, the > key representing the identity should be "tn". should and not must??? why? > Telephone Number strings for "tn" MUST be canonicalized according to > the procedures specified in [I-D.ietf-stir-rfc4474bis] Section 7.2. Actually, this dependency on 4474bis seems odd. Given that the phone number construct is at the core of the work here and this is the essential data object, and this object is presumably intended for use outside of 4474bis, I'd expect that canonicalization algorithm to be here. If 4474 needs to cite/use the algorithm, it can cite here, which it already will have to do. There is no other normative use of 4474 in this document. > 3.2.2.1.2. "uri" - URI identity > > If any of the originating or destination identities is of the form > URI, as defined in [RFC3986], the key representing the identity > should be "uri" URI form of the identity. should and not must? why? > 3.2.2.1.3. Future identity forms > > We recognize that in the future there may be other standard > mechanisms for representing identities. The "orig" and "dest" JSON > > > > > Wendt & Peterson Expires January 23, 2017 [Page 6] > > Internet-Draft PASSporT July 2016 > > > objects with "tn" and "uri" allow for other identity types with > unique keys to represent these forms. Recognition is dandy, but where is the specification detail to support the extensibility? > 3.2.2.1.4. Examples *** Explain these examples, so they aren't merely syntax detail *** > Single Originator to Single Destination example: > > { > "dest":{"uri":["sip:alice@example.com"]}, > "iat":"1443208345", > "orig":{"tn":"12155551212"} > } > > Single Originator to Multiple Destination Identities example: > > { > "dest":{ > "tn":["12125551212"], > "uri":["sip:alice@example.com", > "sip:bob@example.net"] > }, > "iat":"1443208345", > "orig":{"tn":"12155551212"} > } > > 3.2.2.2. "mky" - Media Key claim > > Some protocols that use PASSporT convey hashes for media security > keys within their signaling in order to bind those keys to the > identities established in the signaling layers. One example would be > the DTLS-SRTP key fingerprints carried in SDP via the "a=fingerprint" > attribute; multiple instances of that fingerprint may appear in a > single SDP body corresponding to difference media streams offered. difference -> different? The above text belongs elsewhere, explaining the overall set of capabilities, use cases, and the like In a definitions section like this, focus on definitions, not discussions about use. First use of 'SDP', with no explanation of its meaning. 'DTLS-SRTP' citation? And again, how does this citation slip into a transport-independent object signing spec? > The "mky" value of PASSporT contains a hexadecimal key presentation > of any hash(es) necessary to establish media security via DTLS-SRTP. > This mky value should be formated in a JSON form including the 'alg' > and 'dig' keys with the corresponding algorithm and hexadecimal > values. Note that per guidance of Section 5 of this document any > whitespace and line feeds must be removed. If there is multiple forward pointer. Sometimes these are necessary, but in general they impede reading comprehension. Redundant specification. Saying here something that is also specified elsewhere in the document invites divergence in reader understanding. Cite, perhaps, but do /not/ summarize. Is all of this summary? Anything new here? The reader can't tell. "If there is multiple fingerprint values, more than one,"? huh? Where do 'dig' and 'alg' come from? They are not explicitly introduced, even with a citation. > fingerprint values, more than one, the fingerprint values should be should and not must? why? > constructed as a JSON array denoted by bracket characters. For the > 'dig' key value, the hash value should be the hexadecimal value > without any colons, in order to provide a more efficient, compact > form to be encoded in PASSporT token claim. "in order to provide a more efficient, compact form" is marketing language. It invites debate while offering no useful technical substance. > An example claim with "mky" claim is as follows: > > For an SDP offer that includes the following fingerprint values, > > > > Wendt & Peterson Expires January 23, 2017 [Page 7] > > Internet-Draft PASSporT July 2016 > > > a=fingerprint:sha-256 02:1A:CC:54:27:AB:EB:9C:53:3F:3E:4B:65: > 2E:7D:46:3F:54:42:CD:54:F1:7A:03:A2:7D:F9:B0:7F:46:19:B2 > a=fingerprint:sha-256 4A:AD:B9:B1:3F:82:18:3B:54:02:12:DF:3E: > 5D:49:6B:19:E5:7C:AB:3E:4B:65:2E:7D:46:3F:54:42:CD:54:F1 > > the PASSporT Payload object would be: > > { > "dest":{"uri":["sip:alice@example.com"]}, > "iat":"1443208345", > "mky":[ > { > "alg":"sha-256", > "dig":"021ACC5427ABEB9C533F3E4B652E7D463F5442CD54 > F17A03A27DF9B07F4619B2" > }, > { > "alg":"sha-256", > "dig":"4AADB9B13F82183B540212DF3E5D496B19E57C > AB3E4B652E7D463F5442CD54F1" > } > ], > "orig":{"tn":"12155551212"} > } > > 3.3. PASSporT Signature > > The signature of the PASSporT is created as specified by JWS using > the private key corresponding to the X.509 public key certificate > referenced by the "x5u" header parameter. 'corresponding to' vs. 'included in'? > 4. Extending PASSporT > > PASSporT represents the bare minimum set of claims needed to assert represents vs. is or has? (FWIW, this isn't quibbling. It is an example of the difference between regular prose writing and direct, specification language.) > the originating identity and support the secure propoerties discussed > in various parts of this document, however there will certainly be > both new uses and ways of extending the application and usage of > PASSPorT that requires the ability to extend the defined base set of > claims to represent other information requiring assertion or > validation beyond the identity itself. there's that 'certainly' again and this time it's predicting the future. tsk. don't do that. also, new and extended tends towards redundancy, as does the entire sentence's structure. I think the technical statement is: Passport can be extended to support additional claims. If you want to get really flowery, you might 'as needed' at the end... > 4.1. "ppt" (PASSporT) header parameter > > For the extension of the base set of claims defined in this document, For the -> For > a new JWS header parameter "ppt" MUST be used with a string that > uniquely identifies and points to a profile specification that > defines any new claims that would extend the base set of claims of > PASSporT. extension == profile ?? What is a profile of Passport? Where is this defined? ('jws header parameter'.) What is the purpose of a profile and a profile label? How is it used? 'identifies and points to'? what does points to mean? > > > Wendt & Peterson Expires January 23, 2017 [Page 8] > > Internet-Draft PASSporT July 2016 > > > An example header with an extended PASSporT profile of "foo" is as profile of -> profile name > follows: > > { > "alg":"ES256", > "ppt":"foo", > "typ":"passport", > "x5u":"https://tel.example.org/passport.cer" > } > > 4.2. Extended PASSporT Claims > > Future specifications that define such extensions to the PASSporT [Future] remove [such] remove. there's no context for it. > mechanism MUST explicitly designate what claims they include beyond designate -> specify (it's defining, not appointing) > the base set of claims from this document, the order in which they > will appear, and any further information necessary to implement the > extension. All extensions MUST incorporate the baseline JWT elements > specified in Section 3; claims may only be appended to the claims If all extensions include the baseline, then 'must incorporate' is an odd way to say that This seems best and first handled by earlier in the spec, by providing a syntax (and text) that shows the base set and then an optional extended set. With that setup, it is clear that extensions are always /in addition to/ the base. > object specified; they can never be subtracted or re-ordered. What does it mean to be subtracted? Perhaps 'removed'? Or are they subject to arithmetic modification? > Specifying new claims follows the baseline JWT procedures ([RFC7519] > Section 10.1). Note that understanding an extension as a verifier is > always optional for compliance with this specification (though future That's not a 'note'; that's a fundamental construct. It needs to be stated much earlier and much more distinctly and as an explicitly normative assertion. Also, this seems to be the first reference to the verifier! Also we need a description of the handling of a passport object in terms of creation and consumption.) > specifications or profiles for deployment environments may make other > "ppt" values mandatory). The creator of a PASSporT object cannot > assume that verifiers will understand any given extension. Verifiers > that do support an extension may then trigger appropriate > application-level behavior in the presence of an extension; authors > of extensions should provide appropriate extension-specific guidance > to application developers on this point. > > 5. Deterministic JSON Serialization > > In order to provide a deterministic representation of the PASSporT > Header and Claims, particularly if PASSporT is used across multiple > signaling environments, the JSON header object and JSON Claim object > MUST be computed as follows. The implication that there can be non-deterministic representations is pretty odd and at least needs explanation, assuming the issue is real. > The JSON object MUST follow the rules for the construction of the > thumbprint of a JSON Web Key (JWK) as defined in [RFC7638] Section 3. > Each JSON object MUST contain no whitespace or line breaks before or > after any syntactic elements and with the required members ordered > lexicographically by the Unicode [UNICODE] code points of the member > names. mumble. > In addition, the JSON header and claim members MUST follow the > lexicographical ordering and character and string rules defined in > [RFC7638] Section 3.3. > > > > > Wendt & Peterson Expires January 23, 2017 [Page 9] > > Internet-Draft PASSporT July 2016 > > > 5.1. Example PASSport deterministic JSON form > > For the example PASSporT Payload shown in Section 3.2.2.2, the > following is the deterministic JSON object form. > > {"dest":{"uri":["sip:alice@example.com"],"iat": 1443208345,"mky" > :[{"alg":"sha-256","dig":"021ACC5427ABEB9C533F3E4B652E7D463F5442 > CD54F17A03A27DF9B07F4619B2"},{"alg":"sha-256","dig":"4AADB9B13F8 > 2183B540212DF3E5D496B19E57CAB3E4B652E7D463F5442CD54F1"}], > "orig":{"tn":"12155551212"}} Perhaps explain the steps followed to produce this? Perhaps show the intermediate forms? > 6. Human Readability > > JWT [RFC7519] and JWS [RFC7515] are defined to use Base64 and/or UTF8 > encoding to the Header, Payload, and Signature sections. However, > many personal communications protocols, such as SIP and XMPP, use a > "human readable" format to allow for ease of use and ease of And email and FTP and HTTP and... Actually the use of the form has nothing to do with the purpose of the application. As noted, it merely makes debugging and monitoring easier. > operational debugging and monitoring. As such, specifications using > PASSporT may provide guidance on whether Base64 encoding or plain > text will be used for the construction of the PASSporT Header and > Claim sections. The section is mislabeled and probably out of scope. It's trying to say there there can be alternative encodings of this json object and that this spec won't prohibit that happening by other specs. In all likelihood, this section should be removed. It doesn't specify anything. > 7. Security Considerations > > 7.1. Avoidance of replay and cut and paste attacks > > There are a number of security considerations for use of the token I suspect they are not 'security considerations' as much as 'mechanisms' or 'provisions' > for avoidance of replay and cut and paste attacks. PASSporT tokens > must be sent along with other application level protocol information Huh? You are trying to dictate application-level transport behavior? This smacks of layer/scoping violation. > (e.g. for SIP an INVITE as defined in [RFC3261]). There should be a > link between various information provided in the token and > information provided by the application level protocol information. Why? > These would include: > > o "iat" claim should closely correspond to a date/time the message The semantics of iat are defined earlier. Either there is compliance or there isn't. The discussion here, therefore, should probably say something like "a valid iat claim aids in detecting re-use at a later time." > was originated. It should also be within a relative delta time What is a delta time? How is the reader to know? Where is it defined? I suspect what is meant is that it's deviation from time of origination should be small. If this has a more precise technical definition, then cite it. > that is reasonable for clock drift and transmission time > characteristics associated with the application using the PASSporT > token. > > o "dest" claim is included to prevent the ability to use a > previously originated message to send to another destination party the ability to -> using (or use of) > > > > > > > > Wendt & Peterson Expires January 23, 2017 [Page 10] > > Internet-Draft PASSporT July 2016 > > > 7.2. Solution Considerations > > It should be recognized that the use of this token should not, in > it's own right, be considered a full solution for absolute non- > repudiation of the persona being asserted. This only provides non- > repudiation of the signer of PASSporT. If the signer and the persona huh? So the originator isn't really being validated, as claimed??? > are not one in the same, which can and often will be the case in > telecommunications networks today, protecting the destination party > from being spoofed may take some interpretation or additional > verification of the link between the PASSporT signature and the > persona being asserted. > > In addition, the telecommunications systems and specifications that > use PASSporT should in practice provide mechanisms for: > > o Managing X.509 certificates and X.509 certificate chains to an > authorized trust anchor that can be a trusted entity to all > participants in the telecommunications network Touching this sort of topic is, at the very best, redundant with specifications devoted to X.509. Just cite them and don't attempt to repeat them. > o Accounting for entities that may route calls from other peer or > interconnected telecommunications networks that are not part of > the "trusted" communications network or may not be following the > usage of PASSporT or the profile of PASSporT appropriate to that > network Passport doesn't do calls. Dictating activity involving calls is out of scope. On the other hand, perhaps this qualifies for a discussion about transferring passport objects across administrative (trust) domain boundaries? At best, this section seems to be trying to compensate for the lack of a framework discussion about the problem domain and the practical uses of the various specifications being produced. > o Following best practices around management and security of X.509 > certificates cf, above, about redundancies. Perhaps this is the bullet that should remain, while deleting the other one? > 7.3. Privacy Considerations > > Because PASSporT explicity includes claims of identitifiers of explicity -> explicitly identitifiers -> identifiers > parties involved in communications, times, and potentially other call > detail, care should be taken outside of traditional protected or > private telephony communications paths where there may be concerns > about exposing information to either unintended or illegitimately > intented actors. These identifiers are often exposed through many > communications signaling protocols as of today, but appropriate > precautions should be taken. intented -> intended awk. Illegitimately intended? What does that mean? More fundamentally it isn't clear to me what this is really saying. > 8. IANA Considerations This section just sits here, uncited anywhere else in the document? Each item specified should be referenced in the body of the main specification, with a pointer into this section. > 8.1. Media Type Registration > > 8.1.1. Media Type Registry Contents Additions Requested > > This section registers the "application/passport" media type > [RFC2046] in the "Media Types" registry in the manner described in > > > > > Wendt & Peterson Expires January 23, 2017 [Page 11] > > Internet-Draft PASSporT July 2016 > > > [RFC6838], which can be used to indicate that the content is a > PASSporT defined JWT and JWS. > > o Type name: application > > o Subtype name: passport > > o Required parameters: n/a > > o Optional parameters: n/a > > o Encoding considerations: 8bit; application/passport values outside > the US-ASCII range are encoded using percent encoding as described > in section 2.1 of RFC 3986 (some values may be the empty string), > each separated from the next by a single period ('.') character. > > o Security considerations: See the Security Considerations section > of RFC 7515. > > o Interoperability considerations: n/a > > o Published specification: draft-ietf-stir-passport-05 > > o Applications that use this media type: STIR and other applications > that require identity related assertion > > o Fragment identifier considerations: n/a > > o Additional information: > > * Magic number(s): n/a > > * File extension(s): n/a > > * Macintosh file type code(s): n/a > > o Person and email address to contact for further information: Chris > Wendt, chris-ietf@chriswendt.net > > o Intended usage: COMMON > > o Restrictions on usage: none > > o Author: Chris Wendt, chris-ietf@chriswendt.net > > o Change Controller: IESG > > o Provisional registration? No > > > > Wendt & Peterson Expires January 23, 2017 [Page 12] > > Internet-Draft PASSporT July 2016 > > > 8.2. JSON Web Token Claims Registration > > 8.2.1. Registry Contents Additions Requested > > o Claim Name: "orig" > > o Claim Description: Originating Identity String > > o Change Controller: IESG > > o Specification Document(s): Section 3.2 of draft-ietf-stir- > passport-05 > > o Claim Name: "dest" > > o Claim Description: Destination Identity String > > o Change Controller: IESG > > o Specification Document(s): Section 3.2 of draft-ietf-stir- > passport-05 > > o Claim Name: "mky" > > o Claim Description: Media Key Fingerprint String > > o Change Controller: IESG > > o Specification Document(s): Section 3.2 of draft-ietf-stir- > passport-05 > > 9. Acknowledgements > > Particular thanks to members of the ATIS and SIP Forum NNI Task Group > including Jim McEchern, Martin Dolly, Richard Shockey, John Barnhill, > Christer Holmberg, Victor Pascual Avila, Mary Barnes, Eric Burger for > their review, ideas, and contributions also thanks to Henning > Schulzrinne, Russ Housley, Alan Johnston, Richard Barnes, Mark > Miller, and Ted Hardie for valuable feedback on the technical and > security aspects of the document. Additional thanks to Harsha Bellur > for assistance in coding the example tokens. > > 10. References > > > > > > > > > Wendt & Peterson Expires January 23, 2017 [Page 13] > > Internet-Draft PASSporT July 2016 > > > 10.1. Normative References > > [I-D.ietf-stir-rfc4474bis] > Peterson, J., Jennings, C., Rescorla, E., and C. Wendt, > "Authenticated Identity Management in the Session > Initiation Protocol (SIP)", draft-ietf-stir-rfc4474bis-10 > (work in progress), July 2016. > > [RFC2046] Freed, N. and N. Borenstein, "Multipurpose Internet Mail > Extensions (MIME) Part Two: Media Types", RFC 2046, > DOI 10.17487/RFC2046, November 1996, > . > > [RFC3986] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform > Resource Identifier (URI): Generic Syntax", STD 66, > RFC 3986, DOI 10.17487/RFC3986, January 2005, > . > > [RFC6838] Freed, N., Klensin, J., and T. Hansen, "Media Type > Specifications and Registration Procedures", BCP 13, > RFC 6838, DOI 10.17487/RFC6838, January 2013, > . > > [RFC7515] Jones, M., Bradley, J., and N. Sakimura, "JSON Web > Signature (JWS)", RFC 7515, DOI 10.17487/RFC7515, May > 2015, . > > [RFC7518] Jones, M., "JSON Web Algorithms (JWA)", RFC 7518, > DOI 10.17487/RFC7518, May 2015, > . > > [RFC7519] Jones, M., Bradley, J., and N. Sakimura, "JSON Web Token > (JWT)", RFC 7519, DOI 10.17487/RFC7519, May 2015, > . > > [RFC7638] Jones, M. and N. Sakimura, "JSON Web Key (JWK) > Thumbprint", RFC 7638, DOI 10.17487/RFC7638, September > 2015, . > > [UNICODE] "The Unicode Consortium, "The Unicode Standard"", > . > > 10.2. Informative References > > > > > > > > > Wendt & Peterson Expires January 23, 2017 [Page 14] > > Internet-Draft PASSporT July 2016 > > > [RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, > A., Peterson, J., Sparks, R., Handley, M., and E. > Schooler, "SIP: Session Initiation Protocol", RFC 3261, > DOI 10.17487/RFC3261, June 2002, > . > > [RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S., > Housley, R., and W. Polk, "Internet X.509 Public Key > Infrastructure Certificate and Certificate Revocation List > (CRL) Profile", RFC 5280, DOI 10.17487/RFC5280, May 2008, > . > > [RFC7340] Peterson, J., Schulzrinne, H., and H. Tschofenig, "Secure > Telephone Identity Problem Statement and Requirements", > RFC 7340, DOI 10.17487/RFC7340, September 2014, > . > > Appendix A. Example PASSporT JWS Serialization and Signature > > For PASSporT, there will always be a JWS with the following members: > > o "protected", with the value BASE64URL(UTF8(JWS Protected Header)) > > o "payload", with the value BASE64URL (JWS Payload) > > o "signature", with the value BASE64URL(JWS Signature) > > Note: there will never be a JWS Unprotected Header for PASSporT. > > First, an example PASSporT Protected Header is as follows: > > { > "typ":"passport", > "alg":"ES256", > "x5u":"https://cert.example.org/passport.cer" > } > > This would be serialized to the form: > > {"alg":"ES256","typ":"passport","x5u":"https://cert.example.org/ > passport.cer"} > > Encoding this with UTF8 and BASE64 encoding produces this value: > > eyJhbGciOiJFUzI1NiIsInR5cCI6InBhc3Nwb3J0IiwieDV1IjoiaHR0cHM6Ly9j > ZXJ0LmV4YW1wbGUub3JnL3Bhc3Nwb3J0LmNlciJ9 > > Second, an example PASSporT Payload is as follows: > > > > Wendt & Peterson Expires January 23, 2017 [Page 15] > > Internet-Draft PASSporT July 2016 > > > { > "dest":{"uri":["sip:alice@example.com"]} > "iat":"1443208345", > "orig":{"tn":"12155551212"} > } > > This would be serialized to the form: > > {"dest":{"uri":["sip:alice@example.com"]},"iat":"1443208345", > "orig":{"tn":"12155551212"}} > > Encoding this with the UTF8 and BASE64 encoding produces this value: > > eyJkZXN0Ijp7InVyaSI6WyJzaXA6YWxpY2VAZXhhbXBsZS5jb20iXX0sImlhd > CI6IjE0NDMyMDgzNDUiLCJvcmlnIjp7InRuIjoiMTIxNTU1NTEyMTIifX0 > > Computing the digital signature of the PASSporT Signing Input > ASCII(BASE64URL(UTF8(JWS Protected Header)) || '.' || BASE64URL(JWS > Payload)) > > rq3pjT1hoRwakEGjHCnWSwUnshd0-zJ6F1VOgFWSjHBr8Qjpjlk-cpFYpFYso > jNCpTzO3QfPOlckGaS6hEck7w > > The final PASSporT token is produced by concatenating the values in > the order Header.Payload.Signature with period (',') characters. For > the above example values this would produce the following: > > eyJhbGciOiJFUzI1NiIsInR5cCI6InBhc3Nwb3J0IiwieDV1IjoiaHR0cHM6Ly > 9jZXJ0LmV4YW1wbGUub3JnL3Bhc3Nwb3J0LmNlciJ9 > . > eyJkZXN0Ijp7InVyaSI6WyJzaXA6YWxpY2VAZXhhbXBsZS5jb20iXX0sImlhd > CI6IjE0NDMyMDgzNDUiLCJvcmlnIjp7InRuIjoiMTIxNTU1NTEyMTIifX0 > . > rq3pjT1hoRwakEGjHCnWSwUnshd0-zJ6F1VOgFWSjHBr8Qjpjlk-cpFYpFYso > jNCpTzO3QfPOlckGaS6hEck7w > > A.1. X.509 Private Key Certificate for Example > > -----BEGIN EC PRIVATE KEY----- > MHcCAQEEIFeZ1R208QCvcu5GuYyMfG4W7sH4m99/7eHSDLpdYllFoAoGCCqGSM49 > AwEHoUQDQgAE8HNbQd/TmvCKwPKHkMF9fScavGeH78YTU8qLS8I5HLHSSmlATLcs > lQMhNC/OhlWBYC626nIlo7XeebYS7Sb37g== > -----END EC PRIVATE KEY----- > > > > > > > > > Wendt & Peterson Expires January 23, 2017 [Page 16] > > Internet-Draft PASSporT July 2016 > > > A.2. X.509 Public Key Certificate for Example > > -----BEGIN PUBLIC KEY----- > MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE8HNbQd/TmvCKwPKHkMF9fScavGeH > 78YTU8qLS8I5HLHSSmlATLcslQMhNC/OhlWBYC626nIlo7XeebYS7Sb37g== > -----END PUBLIC KEY----- > > Authors' Addresses > > Chris Wendt > Comcast > One Comcast Center > Philadelphia, PA 19103 > USA > > Email: chris-ietf@chriswendt.net > > > Jon Peterson > Neustar Inc. > 1800 Sutter St Suite 570 > Concord, CA 94520 > US > > Email: jon.peterson@neustar.biz > > > > > > > > > > > > > > > > > > > > > > > > > > > Wendt & Peterson Expires January 23, 2017 [Page 17] -- Dave Crocker Brandenburg InternetWorking bbiw.net -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Fri Jul 29 06:57:41 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BC36F12D0D3 for ; Fri, 29 Jul 2016 06:57:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.012 X-Spam-Level: X-Spam-Status: No, score=-1.012 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_NEUTRAL=0.779, T_DKIM_INVALID=0.01] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=neutral reason="invalid (public key: not available)" header.d=standardstrack.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dEtRol9gcVD4 for ; Fri, 29 Jul 2016 06:57:35 -0700 (PDT) Received: from biz104.inmotionhosting.com (biz104.inmotionhosting.com [173.247.247.235]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C6CD112D60E for ; Fri, 29 Jul 2016 06:57:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=standardstrack.com; s=default; h=To:References:Message-Id:Cc:Date: In-Reply-To:From:Content-Type:Mime-Version:Subject; bh=oGVc8UF525kLg0lJ4l0ZopLJJtdCLX6NQVMZI83L/rY=; b=I/gi8MHCHHHYvGqrGtYDZKA7FK nqqUn5KlU7h3wMG8P1ceuHjhNqqJOES9GOC2nmCQM384qEVVpWGeD4zzF3zqWCDmLdFl+g6xqerD3 loa10AjXxxAnogL8Z/TgK5Bpr8k5rhxGkPRY49xT7y5p83zqfOSUu5jPMfrzv92w8Djs=; Received: from ip68-100-196-239.dc.dc.cox.net ([68.100.196.239]:56379 helo=[192.168.15.107]) by biz104.inmotionhosting.com with esmtpsa (TLSv1:DHE-RSA-AES256-SHA:256) (Exim 4.86_1) (envelope-from ) id 1bT8Hv-0007NW-QJ; Fri, 29 Jul 2016 06:57:31 -0700 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) Content-Type: multipart/signed; boundary="Apple-Mail=_F3E4A68D-098D-4B4C-AFA8-46D70D4C1CDF"; protocol="application/pgp-signature"; micalg=pgp-sha256 X-Pgp-Agent: GPGMail From: Eric Burger In-Reply-To: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> Date: Fri, 29 Jul 2016 09:57:18 -0400 Message-Id: References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> To: Crocker Dave X-Mailer: Apple Mail (2.3124) X-OutGoing-Spam-Status: No, score=-2.9 X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - biz104.inmotionhosting.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - standardstrack.com X-Get-Message-Sender-Via: biz104.inmotionhosting.com: authenticated_id: eburger+standardstrack.com/only user confirmed/virtual account not confirmed X-Authenticated-Sender: biz104.inmotionhosting.com: eburger@standardstrack.com X-Source: X-Source-Args: X-Source-Dir: Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Review of: draft-ietf-stir-passport-05 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Jul 2016 13:57:39 -0000 --Apple-Mail=_F3E4A68D-098D-4B4C-AFA8-46D70D4C1CDF Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Dave - Thanks for the review. I agree with a lot of your meta points, most = especially that a major revision during last call that makes some not = insubstantial syntactic changes is unusual, to say the least, especially = as there has been no list discussion on the changes. That said, it is my = belief that for once, in this case silence is acceptance. Just so it=E2=80= =99s on the list, my silence was acceptance (although grumbling = acceptance because the changes blew up my implementation and for = personal reasons I won=E2=80=99t be able to try to implement the new = stuff until September). Let me attempt to defend one thing that I agree should have some = attached text to resolve. There *are* STIR use cases extant that use the = mechanism beyond PASSporT. However, *none* of them are appropriate for = work in the IETF. If some of the folks who are on this list that are = doing that work would would not mind opening the curtain just a tiny = bit, that could allay fears that we are doing generalization and = extension for generalization and extension=E2=80=99s sake. Another thing that perhaps we need to put into the document suite = relates to your comment about certificate management. In a normal, = interoperable protocol one would have a single certificate management = mechanism that everybody agrees to. The problem is the approach used for = certificate management in the case of STIR/PASSporT is directly an = embodiment of policy. Because the target audience for the protocol is = (today) highly regulated with differing national policies and policy = bodies, it is just not possible to mandate a particular certificate = policy (i.e., your comment about key rollover and one I think you = obliquely touched upon, what is the Subject of the key doing the = signing). The WG is producing a straw proposal that would provide some = semblance of a baseline, but it is not clear there will be more than one = or two implementations of that policy. All this said, I will also defend the document in that (admittedly with = assistance from me and Chris Wendt) an undergraduate student coded a = STIR authentication service and STIR validation service in under a year, = with the challenge of a very a high velocity of dramatic changes (as = opposed to the modest syntactic changes that just occurred in the last = draft), says the document is not totally hopeless. - Eric > On Jul 28, 2016, at 1:37 PM, Dave Crocker wrote: >=20 >=20 >=20 > Review of: draft-ietf-stir-passport-05 > Date: 27 July 2016 > Revied by: D. Crocker >=20 >=20 > Summary: >=20 > The 'Persona Assertion Token' specification defines an object = containing > multiple attributes that are intended to be used for authentication, > integrity and non-repudiation, such as validating the originator of a > SIP telephone call. The object is intended to be application- and > transport-independent. In effect, the object links certification = details > to application details and/or transport details. >=20 > Although the text provides details of 'how' to compose a passport = token, > it never actually says what passport is. There are some later comments > that imply what it is, or seem to assume a knowledge of what it is, = but > it's never defined as a technical construct. By way of example, how = does > it differ from the function of an X.509 cert? >=20 > The specification has problems with its explanation of purpose and its > apparent scope, as well as occasional lack of clarity or > correctness. It even has quite a few typographical errors that would > have been trivially detected by a spelling corrector. >=20 > The document was only first produced in February, with 4 revisions in > the last 3 months, including one during Last Call. And the recent > revisions have included quite substantive changes. Discussion about = the > draft on the wg mailing list has been thin. Also, during the wg = session > in Berlin, discussion seemed to include a fair amount of reference to > what 'might' be done -- eg, tailoring use through profiles or encoding > for SIP or... -- rather than clarity about how this specification = would > definitely be used. It suggests the possibility of less stability in > community understanding of the specification than one would wish for = an > IETF proposed standard. >=20 > The document is /not/ ready for publication. >=20 >=20 >=20 > This appears to be a specification for something that is for far more > general use than simply doing caller-id authentication; as such it > appears to go beyond the scope of the working group's charter. This > might be acceptable, if the solution provided adequately covered what > /is/ in scope and were still timely and sufficiently 'efficient'. = However the working group has taken 3 years to produce this work and = there are no other use-cases presented and no other specifications for = use, to justify the purported generality. As such, the generality is = purely theoretical. Worse, there is a poor track-record of such efforts = proving successful at being more general. Instead, they impose the = overhead of generality without the benefit. >=20 > The document is written with the apparent expectation that the reader > has quite a bit of prior knowledge but it isn't stated explicitly. = This > needs to be written for a wider audience than just those already in = the > wg and more than those already familiar with the work. If there are > specific details the reader must know ahead of time, state or cite = them > early and explicitly >=20 > As an example, the document is really built on top of JWT but doesn't > introduce the reference or details about this until section 3. (The > passing reference in section 2 does not explain that JWT is = foundational > to the current work.) >=20 > As to the choice of JWT, it seems odd, since it isn't natural to the = SIP context, which is essential for the chartered work, and therefore = requires an additional layer of translation for use with SIP. >=20 > The document title and the content use the term 'persona' but there is > nothing in this document that pertains to any of the normal, technical > -- or even informal -- uses of the term. So it might be a clever turn = of > phrase, but it appears to be significantly inappropriate, or at least > misleading. (Perhaps the goal is to sustain the unusual choices that = SIP > made, such as with the term 'identity', deviating from usages in the > world of online identity?...) >=20 > The document desperately needs a carefully-written terminology = section. >=20 > The specification is dominated by heavy focus on the details and > mechanisms, without much that covers purposes and functions. The text = is > heavy with redundant acronyms usage, to the point of distraction. > (Imagine specifying http by having every paragraph say that ASCII (or > Unicode or whatever) is being used. Assert packaging-related details > only where needed, rather than feeling that every bit of technical > information must be seasoned with references to JWT, JWS, or whatever. >=20 > Algorithmic details often are specified in non-linear sequence, eg, if = B > do C after doing A and before doing C. This makes it difficult to > acquire an simple understanding of the sequence. Algorithms need to be > presented in as linear a fashion as possible, and preferable include > pseudo-code, to be that much more concise. >=20 > In terms of pragmatics, here are two operational questions that I = can't > answer, based on this specification, and yet they are fundamental to = the > utility of this work. >=20 > How is key rollover done? >=20 > How is delegation done, such as for use by authorized third > parties? >=20 > As an example that the document needs much more careful proofreading, > the terms header and headers appear to be used inconsistently and > possibly incorrectly. >=20 > Also I note that a revision of the draft was posted during Last Call. > This can create confusion or extra work, to reconcile things. =46rom a > quick scan of the revision's diff, it doesn't appear that the changes > affect this review... maybe. >=20 > Also, having a Last Call that overlaps with an IETF meeting is not a > good way to encourage adequate attention to the production of reviews, > although the document really needed them. >=20 >=20 >=20 >=20 >=20 > Detailed Comments > ----------------- >=20 >=20 >> STIR C. = Wendt >> Internet-Draft = Comcast >> Intended status: Standards Track J. = Peterson >> Expires: January 23, 2017 Neustar = Inc. >> July 22, = 2016 >>=20 >>=20 >> Persona Assertion Token >> draft-ietf-stir-passport-05 >>=20 >> Abstract >>=20 >> This document defines a token format for verifying with non- >=20 > [format] remove or remove [token] >=20 > Is the timestamp the basis of claiming non-repudiation? >=20 >=20 >> repudiation the sender of and authorization to send information >> related to the originator of personal communications. A >=20 > 'info related to'... what does this mean? >=20 >=20 >> cryptographic signature is defined to protect the integrity of the >> information used to identify the originator of a personal >> communications session (e.g. the telephone number or URI) and = verify >> the accuracy of this information at the destination. The >=20 > 'accuracy'? validates authorship, not validity, I suspect. >=20 > A signature's primary purpose usually is authenticate origination, = authorship, or the like, where integrity is a side-effect of the = methodology. Integrity as the primary function would typically occur = only when the identity of the signer need be no more than something like = 'whomever I interacted with previously'. I suspect that such a = session-limited identity semantic is not, in fact, the intent here. >=20 >=20 >> cryptographic signature is defined with the intention that it can >> confidently verify the originating persona even when the signature = is >> sent to the destination party over an unsecure channel. The = Persona >=20 > unsecure -> insecure (unless the intend is reference to a loan?) >=20 >=20 >> Assertion Token (PASSporT) is particularly useful for many personal >> communications applications over IP networks and other multi-hop >> interconnection scenarios where the originating and destination >> parties may not have a direct trusted relationship. >>=20 >> Status of This Memo >>=20 >> This Internet-Draft is submitted in full conformance with the >> provisions of BCP 78 and BCP 79. >>=20 >> Internet-Drafts are working documents of the Internet Engineering >> Task Force (IETF). Note that other groups may also distribute >> working documents as Internet-Drafts. The list of current = Internet- >> Drafts is at http://datatracker.ietf.org/drafts/current/. >>=20 >> Internet-Drafts are draft documents valid for a maximum of six = months >> and may be updated, replaced, or obsoleted by other documents at = any >> time. It is inappropriate to use Internet-Drafts as reference >> material or to cite them other than as "work in progress." >>=20 >> This Internet-Draft will expire on January 23, 2017. >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page = 1] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> Copyright Notice >>=20 >> Copyright (c) 2016 IETF Trust and the persons identified as the >> document authors. All rights reserved. >>=20 >> This document is subject to BCP 78 and the IETF Trust's Legal >> Provisions Relating to IETF Documents >> (http://trustee.ietf.org/license-info) in effect on the date of >> publication of this document. Please review these documents >> carefully, as they describe your rights and restrictions with = respect >> to this document. Code Components extracted from this document = must >> include Simplified BSD License text as described in Section 4.e of >> the Trust Legal Provisions and are provided without warranty as >> described in the Simplified BSD License. >>=20 >> Table of Contents >>=20 >> 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . = 3 >> 2. Token Overview . . . . . . . . . . . . . . . . . . . . . . . = 4 >> 3. PASSporT Definition . . . . . . . . . . . . . . . . . . . . . = 4 >> 3.1. PASSporT Header . . . . . . . . . . . . . . . . . . . . . = 4 >> 3.1.1. "typ" (Type) Header Parameter . . . . . . . . . . . . = 4 >> 3.1.2. "alg" (Algorithm) Header Parameter . . . . . . . . . = 5 >> 3.1.3. "x5u" (X.509 URL) Header Parameter . . . . . . . . . = 5 >> 3.2. PASSporT Payload . . . . . . . . . . . . . . . . . . . . = 5 >> 3.2.1. JWT defined claims . . . . . . . . . . . . . . . . . = 5 >> 3.2.1.1. "iat" - Issued at claim . . . . . . . . . . . . . = 5 >> 3.2.2. PASSporT specific claims . . . . . . . . . . . . . . = 6 >> 3.2.2.1. Originating and Destination Identity Claims . . . = 6 >> 3.2.2.2. "mky" - Media Key claim . . . . . . . . . . . . . = 7 >> 3.3. PASSporT Signature . . . . . . . . . . . . . . . . . . . = 8 >> 4. Extending PASSporT . . . . . . . . . . . . . . . . . . . . . = 8 >> 4.1. "ppt" (PASSporT) header parameter . . . . . . . . . . . . = 8 >> 4.2. Extended PASSporT Claims . . . . . . . . . . . . . . . . = 9 >> 5. Deterministic JSON Serialization . . . . . . . . . . . . . . = 9 >> 5.1. Example PASSport deterministic JSON form . . . . . . . . = 10 >> 6. Human Readability . . . . . . . . . . . . . . . . . . . . . . = 10 >> 7. Security Considerations . . . . . . . . . . . . . . . . . . . = 10 >> 7.1. Avoidance of replay and cut and paste attacks . . . . . . = 10 >> 7.2. Solution Considerations . . . . . . . . . . . . . . . . . = 11 >> 7.3. Privacy Considerations . . . . . . . . . . . . . . . . . = 11 >> 8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . = 11 >> 8.1. Media Type Registration . . . . . . . . . . . . . . . . . = 11 >> 8.1.1. Media Type Registry Contents Additions Requested . . = 11 >> 8.2. JSON Web Token Claims Registration . . . . . . . . . . . = 13 >> 8.2.1. Registry Contents Additions Requested . . . . . . . . = 13 >> 9. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . = 13 >> 10. References . . . . . . . . . . . . . . . . . . . . . . . . . = 13 >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page = 2] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> 10.1. Normative References . . . . . . . . . . . . . . . . . . = 14 >> 10.2. Informative References . . . . . . . . . . . . . . . . . = 14 >> Appendix A. Example PASSporT JWS Serialization and Signature . . = 15 >> A.1. X.509 Private Key Certificate for Example . . . . . . . . = 16 >> A.2. X.509 Public Key Certificate for Example . . . . . . . . = 17 >> Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . = 17 >>=20 >> 1. Introduction >>=20 >> In today's IP-enabled telecommunications world, there is a growing >> concern about the ability to trust incoming invitations for >> communications sessions, including video, voice and messaging. >> [RFC7340] As an example, modern telephone networks provide the >> ability to spoof the calling party telephone number for many >> legitimate purposes including providing network features and = services >> on the behalf of a legitimate telephone number. However, as we = have >> seen, bad actors have taken advantage of this ability for >> illegitimate and fraudulent purposes meant to trick telephone users >> to believe they are someone they are not. This problem can be >> extended to many emerging forms of personal communications. >>=20 >> This document defines a common method for creating and validating a >=20 > [common] delete >=20 >=20 >> token that cryptographically verifies an originating identity, or >> more generally a URI or application specific identity string >=20 > 'identity string'? what does this mean? >=20 > 'app string id'? what does this mean? >=20 >=20 >> representing the originator of personal communications. Through >> extended profiles other information relevant to the personal >> communications can also be attached to the token. The primary goal >> of PASSporT is to provide a common framework for signing persona >=20 > What is a 'persona'? Where is this construct introduced or cited and = explained? >=20 > 'profiles'? Where is this construct introduced or cited and = explained? >=20 >=20 >> related information in an extensible way. A secondary goal is to >=20 > It seems to also be primary. >=20 > (PPT provides a framework for signing related information) ? >=20 >=20 >> provide this functionality independent of any specific personal >> communications signaling call logic, so that creation and >> verification of persona information can be implemented in a = flexible >> way and can be used in many personal communications applications >> including end-to-end applications that require different signaling >> protocols. It is anticipated that signaling protocol specific >> guidance will be provided in other related documents and >> specifications to specify how to use and transport PASSporT tokens, >=20 > specs to spec... awkward phrasing >=20 > as always, a specification that declares what is 'anticipated' moves = into purely hypothetical, which too-often proves to be wishful fantasy. = The reference doesn't specify anything and it creates a dependency that = well might not be satisfied. >=20 > 'tokens'? Where is this constructed introduced, cited or explained? = Use of a term like this implies that there is some distinctive meaning, = but really there isn't. This is a format specification. That's all. >=20 > If there is a claim that the term token does have significance here, = then please explain it. For example, how is this token to be used? >=20 > If the term is used merely as an inheritance from JWT, then cite that = early, to justify the term. >=20 >=20 >> however this is intentionally out of scope for this document. >>=20 >> Note: As of the authoring of this document, >> [I-D.ietf-stir-rfc4474bis] provides details of how to use PASSporT >> within SIP signaling for the signing and verification of telephone >> numbers. >=20 > remove Note. Or make it a note to RFC Editor to remove it, or = rephrase so it's useful 10 years from now. >=20 >=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page = 3] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> 2. Token Overview >>=20 >> Tokens are a convenient way of encapsulating information with >=20 > Why? What are the alternatives? Why is this the starting point? >=20 >=20 >> associated digital signatures. They are used in many applications >=20 > Such as? >=20 > Anyhow, this section seems to take the construct of 'token' as being = an established term of art. It isn't. Or, at least, I've no idea what = is meant here that distinguishes a token from anything else, such as = other forms of encapsulation. Say/cite what a token is, if it is such a = distinctive thing. Say/cite how it differs from alternatives, if its = superiority is going to be touted. >=20 >=20 >> that require authentication, authorization, encryption, non- >> repudiation and other use cases. JSON Web Token (JWT) [RFC7519] = and >> JSON Web Signature (JWS) [RFC7515] are designed to provide a = compact >> form for many of these purposes and define a specific method and >> syntax for signing a specific set of information or "claims" within >> the token and therefore providing an extensible set of claims. >> Additionally, JWS provides extensible mechanisms for specifying the >> method and cryptographic algorithms used for the associated digital >> signatures. >=20 > Note that there is nothing in the above text that actually explains = what a token is or how it differs from things that aren't tokens. >=20 >=20 >> 3. PASSporT Definition >=20 > This section is not a definition. It's more like structure, or = format, or foundation or encoding. >=20 >=20 >> The PASSporT is constructed based on JWT [RFC7519] and JWS = [RFC7515] >> specifications. JWS defines the use of JSON data structures in a >> specified canonical format for signing data corresponding to JOSE >> header, JWS Payload, and JWS Signature. JWT defines specific set = of >=20 > specific set -> a set >=20 >=20 >> claims that are represented by specified key value pairs which can = be >> extended with custom keys for specific applications. >>=20 >> 3.1. PASSporT Header >>=20 >> The JWS token header is a JOSE header [RFC7515] that defines the = type >> and encryption algorithm used in the token. >=20 > The section starts with structure detail and ends with purpose. This = should be swapped. >=20 >=20 >> An example of the header for the case of an ECDSA P-256 digital >> signature would be the following, >=20 > How is reader to know what that long string means? Is the doc only for > the cognoscenti? if so, which cognoscenti? >=20 >=20 >> { >> "typ":"passport", >> "alg":"ES256", >> "x5u":"https://cert.example.org/passport.cer" >> } >=20 > *** EXPLAIN EXAMPLES, PLEASE *** >=20 >=20 >> 3.1.1. "typ" (Type) Header Parameter >>=20 >> JWS defines the "typ" (Type) Header Parameter to declare the media >> type of the JWS. >=20 > media type? IANA citation needed. (It was in an earlier version of = the draft!) >=20 >=20 >> For PASSporT Token the "typ" header MUST minimally include and = begin >> with "passport". This represents that the encoded token is a JWT = of >> type passport. >=20 > Is it possible to begin with it and not include it? That is, = 'include' is redundant. 'minimally' is also not information, but it = raises the question: The other two attributes aren't required??? >=20 > Also, this subsection is part of an Overview. Why does it have = normative content? Or is this not really an overview? >=20 >=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page = 4] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> 3.1.2. "alg" (Algorithm) Header Parameter >>=20 >> For PASSporT, the "alg" should be defined as follows, for the >> creation and verification of PASSporT tokens and their digital >> signatures ES256 MUST be implemented. >>=20 >> Note that JWA [RFC7518] defines other algorithms that may be = utilized >> or updated in the future depending on cryptographic strength >> requirements guided by current security best practice. >>=20 >> 3.1.3. "x5u" (X.509 URL) Header Parameter >>=20 >> As defined in JWS, the "x5u" header parameter is used to provide a >> URI [RFC3986] referring to the resource for the X.509 public key >> certificate or certificate chain [RFC5280] corresponding to the key >=20 > So this service uses a classic X.509 authentication hierarchy? That's = a key design point, only mentioned in a third-level section. >=20 >=20 >> used to digitally sign the JWS. Note: The definition of what the = URI >> represents in terms of the actor serving the X.509 public key is = out >=20 > 'actor serving the X.509 public key' ? what does that mean? >=20 >=20 >> of scope of this document. However, generally this would = correspond >> to an HTTPS or DNSSEC resource with the guidance that it MUST be a >=20 > [a] remove >=20 >=20 >> TLS protected, per JWS spec. >=20 > This /object/ specification (that is transport independent) dictates = /transport/ security??? This is probably wrong, but at least needs = careful explanation. >=20 >=20 >>=20 >> 3.2. PASSporT Payload >>=20 >> The token payload claims should consist of the information which >=20 > [payload] remove; at best it's redundant >=20 > 'should'? not MUST? why? >=20 >> needs to be verified at the destination party. This claim should >> correspond to a JWT claim [RFC7519] and be encoded as defined by = the >> JWS Payload [RFC7515] >=20 > should? why >=20 > correspond??? what does that mean, in technical terms? >=20 >=20 >> The PASSporT defines the use of a number of standard JWT defined >=20 > "The PASSporT" is an affectation. Both the 'the' and the use of case. >=20 >=20 >> headers as well as two new custom headers corresponding to the two >=20 > header/s/? >=20 > corresponding? referring? describing? identifying? addressing? >=20 >=20 >> parties associated with personal communications, the originator and >> terminator. These headers or key value pairs are detailed below. >=20 > These headers or key value pairs are -> This information is >=20 >=20 >> Key values outside the US-ASCII range should be encoded using = percent >> encoding as described in section 2.1 of RFC 3986, case normalized = as >> described in 6.2.2.1 of [RFC3986]. Matching of these values should >> use string exact match. >>=20 >> 3.2.1. JWT defined claims >=20 > When something like this is imported from another spec, there needs to > be a precise pointer to the specific part of the spec defining it. >=20 >=20 >> 3.2.1.1. "iat" - Issued at claim >>=20 >> The JSON claim MUST include the "iat" [RFC7519] defined claim = issued >> at. As defined this should be set to a date cooresponding to the >=20 > issued at -> "Issued At". >=20 > It would be better to explicitly cite section 4.1.6 in that RFC. = Readers should not have to search an entire document to find the detail = being referenced. >=20 > Also, note the MUST here. I suspect this conflicts with the normative = language above in the 'overview'. >=20 >=20 >> origination of the personal communications. The time value should = be >> of the format defined in [RFC7519] Section 2 NumericDate. This is >> included for securing the token against replay and cut and paste >>=20 >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page = 5] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> attacks, as explained further in the security considerations in >> section 7. >>=20 >> 3.2.2. PASSporT specific claims >>=20 >> 3.2.2.1. Originating and Destination Identity Claims >>=20 >> Baseline PASSporT defines claims that convey the identity of the >=20 > "Baseline PASSporT defines claims" ? First reference in a 4th-level = section??? >=20 >=20 >> origination and destination of personal communications. There are >=20 > 'personal'? so this can't be used by and between companies? Really, = there is nothing about any of this that pertains to the type of users or = even the content of the communication. >=20 > What is the exact definition or origination and destination? For = example, there is an important distinction between the person making a = call vs. the device they are using, versus the provider they are going = through. Which is meant here and how is the reader to know? (cf, call = for a terminology section.) >=20 >=20 >> two claims that are required for PASSporT, the "orig" and "dest" >> claims. Both "orig" and "dest" should have values that are JSON >> objects that include identities represented by key value pairs, = where >=20 > 'key value pairs' aren't 'claims'? >=20 > should and not must? why? >=20 >=20 >> the key represents an identity type and the value is the identity >> string. Currently, these identities can be represented as either >=20 > So, there is expectation of other types? There needs to be a pointer = to an IANA registry. >=20 >=20 >> telephone numbers or Uniform Resource Indicators (URIs). The >> definition of how telephone numbers or URIs and examples are = provided >> below. >>=20 >> The "orig" JSON object MUST only have one key value pair = representing >> the asserted identity of any type (currently either "tn" or "uri") = of >> the originator of the personal communications signaling. >>=20 >> The "dest" JSON object MUST have at least have one key value pair, >> but could have multiple identity types (i.e. "tn" and/or "uri") but >> only one of each. Additionaly, in the case of "dest" only, the >> identity type key value MUST be an array signaled by standard JSON >> brackets, even when there is a single identity value in the = identity >> type key value. >>=20 >> 3.2.2.1.1. "tn" - Telephone Number identity >=20 > A document that uses five-levels of section numbering warrants = reconsideration of its structure. >=20 >=20 >>=20 >> If the originating or destination identity is a telephone number, = the >> key representing the identity should be "tn". >=20 > should and not must??? why? >=20 >=20 >> Telephone Number strings for "tn" MUST be canonicalized according = to >> the procedures specified in [I-D.ietf-stir-rfc4474bis] Section 7.2. >=20 > Actually, this dependency on 4474bis seems odd. >=20 > Given that the phone number construct is at the core of the work here = and this is the essential data object, and this object is presumably = intended for use outside of 4474bis, I'd expect that canonicalization = algorithm to be here. >=20 > If 4474 needs to cite/use the algorithm, it can cite here, which it = already will have to do. There is no other normative use of 4474 in = this document. >=20 >=20 >=20 >> 3.2.2.1.2. "uri" - URI identity >>=20 >> If any of the originating or destination identities is of the form >> URI, as defined in [RFC3986], the key representing the identity >> should be "uri" URI form of the identity. >=20 > should and not must? why? >=20 >=20 >> 3.2.2.1.3. Future identity forms >>=20 >> We recognize that in the future there may be other standard >> mechanisms for representing identities. The "orig" and "dest" JSON >>=20 >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page = 6] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> objects with "tn" and "uri" allow for other identity types with >> unique keys to represent these forms. >=20 > Recognition is dandy, but where is the specification detail to support = the extensibility? >=20 >=20 >> 3.2.2.1.4. Examples >=20 > *** Explain these examples, so they aren't merely syntax detail *** >=20 >=20 >> Single Originator to Single Destination example: >>=20 >> { >> "dest":{"uri":["sip:alice@example.com"]}, >> "iat":"1443208345", >> "orig":{"tn":"12155551212"} >> } >>=20 >> Single Originator to Multiple Destination Identities example: >>=20 >> { >> "dest":{ >> "tn":["12125551212"], >> "uri":["sip:alice@example.com", >> "sip:bob@example.net"] >> }, >> "iat":"1443208345", >> "orig":{"tn":"12155551212"} >> } >>=20 >> 3.2.2.2. "mky" - Media Key claim >>=20 >> Some protocols that use PASSporT convey hashes for media security >> keys within their signaling in order to bind those keys to the >> identities established in the signaling layers. One example would = be >> the DTLS-SRTP key fingerprints carried in SDP via the = "a=3Dfingerprint" >> attribute; multiple instances of that fingerprint may appear in a >> single SDP body corresponding to difference media streams offered. >=20 > difference -> different? >=20 > The above text belongs elsewhere, explaining the overall set of = capabilities, use cases, and the like In a definitions section like = this, focus on definitions, not discussions about use. >=20 > First use of 'SDP', with no explanation of its meaning. >=20 > 'DTLS-SRTP' citation? >=20 > And again, how does this citation slip into a transport-independent = object signing spec? >=20 >=20 >=20 >> The "mky" value of PASSporT contains a hexadecimal key presentation >> of any hash(es) necessary to establish media security via = DTLS-SRTP. >> This mky value should be formated in a JSON form including the = 'alg' >> and 'dig' keys with the corresponding algorithm and hexadecimal >> values. Note that per guidance of Section 5 of this document any >> whitespace and line feeds must be removed. If there is multiple >=20 > forward pointer. Sometimes these are necessary, but in general they = impede reading comprehension. >=20 > Redundant specification. Saying here something that is also specified = elsewhere in the document invites divergence in reader understanding. = Cite, perhaps, but do /not/ summarize. >=20 > Is all of this summary? Anything new here? The reader can't tell. >=20 > "If there is multiple fingerprint values, more than one,"? huh? >=20 > Where do 'dig' and 'alg' come from? They are not explicitly = introduced, even with a citation. >=20 >=20 >> fingerprint values, more than one, the fingerprint values should be >=20 > should and not must? why? >=20 >=20 >> constructed as a JSON array denoted by bracket characters. For the >> 'dig' key value, the hash value should be the hexadecimal value >> without any colons, in order to provide a more efficient, compact >> form to be encoded in PASSporT token claim. >=20 > "in order to provide a more efficient, compact form" is marketing = language. It invites debate while offering no useful technical = substance. >=20 >=20 >> An example claim with "mky" claim is as follows: >>=20 >> For an SDP offer that includes the following fingerprint values, >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page = 7] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> a=3Dfingerprint:sha-256 02:1A:CC:54:27:AB:EB:9C:53:3F:3E:4B:65: >> 2E:7D:46:3F:54:42:CD:54:F1:7A:03:A2:7D:F9:B0:7F:46:19:B2 >> a=3Dfingerprint:sha-256 4A:AD:B9:B1:3F:82:18:3B:54:02:12:DF:3E: >> 5D:49:6B:19:E5:7C:AB:3E:4B:65:2E:7D:46:3F:54:42:CD:54:F1 >>=20 >> the PASSporT Payload object would be: >>=20 >> { >> "dest":{"uri":["sip:alice@example.com"]}, >> "iat":"1443208345", >> "mky":[ >> { >> "alg":"sha-256", >> "dig":"021ACC5427ABEB9C533F3E4B652E7D463F5442CD54 >> F17A03A27DF9B07F4619B2" >> }, >> { >> "alg":"sha-256", >> "dig":"4AADB9B13F82183B540212DF3E5D496B19E57C >> AB3E4B652E7D463F5442CD54F1" >> } >> ], >> "orig":{"tn":"12155551212"} >> } >>=20 >> 3.3. PASSporT Signature >>=20 >> The signature of the PASSporT is created as specified by JWS using >> the private key corresponding to the X.509 public key certificate >> referenced by the "x5u" header parameter. >=20 > 'corresponding to' vs. 'included in'? >=20 >=20 >> 4. Extending PASSporT >>=20 >> PASSporT represents the bare minimum set of claims needed to assert >=20 > represents vs. is or has? >=20 > (FWIW, this isn't quibbling. It is an example of the difference = between regular prose writing and direct, specification language.) >=20 >=20 >> the originating identity and support the secure propoerties = discussed >> in various parts of this document, however there will certainly be >> both new uses and ways of extending the application and usage of >> PASSPorT that requires the ability to extend the defined base set = of >> claims to represent other information requiring assertion or >> validation beyond the identity itself. >=20 > there's that 'certainly' again and this time it's predicting the = future. > tsk. don't do that. also, new and extended tends towards redundancy, = as > does the entire sentence's structure. I think the technical statement = is: >=20 > Passport can be extended to support additional claims. >=20 > If you want to get really flowery, you might 'as needed' at the end... >=20 >=20 >> 4.1. "ppt" (PASSporT) header parameter >>=20 >> For the extension of the base set of claims defined in this = document, >=20 > For the -> For >=20 >=20 >> a new JWS header parameter "ppt" MUST be used with a string that >> uniquely identifies and points to a profile specification that >> defines any new claims that would extend the base set of claims of >> PASSporT. >=20 > extension =3D=3D profile ?? >=20 > What is a profile of Passport? Where is this defined? >=20 > ('jws header parameter'.) >=20 > What is the purpose of a profile and a profile label? How is it used? >=20 >=20 > 'identifies and points to'? what does points to mean? >=20 >=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page = 8] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> An example header with an extended PASSporT profile of "foo" is as >=20 > profile of -> profile name >=20 >=20 >> follows: >>=20 >> { >> "alg":"ES256", >> "ppt":"foo", >> "typ":"passport", >> "x5u":"https://tel.example.org/passport.cer" >> } >>=20 >> 4.2. Extended PASSporT Claims >>=20 >> Future specifications that define such extensions to the PASSporT >=20 > [Future] remove >=20 > [such] remove. there's no context for it. >=20 >=20 >> mechanism MUST explicitly designate what claims they include beyond >=20 > designate -> specify (it's defining, not appointing) >=20 >=20 >> the base set of claims from this document, the order in which they >> will appear, and any further information necessary to implement the >> extension. All extensions MUST incorporate the baseline JWT = elements >> specified in Section 3; claims may only be appended to the claims >=20 > If all extensions include the baseline, then 'must incorporate' is an = odd way to say that >=20 > This seems best and first handled by earlier in the spec, by providing = a syntax (and text) that shows the base set and then an optional = extended set. With that setup, it is clear that extensions are always = /in addition to/ the base. >=20 >=20 >> object specified; they can never be subtracted or re-ordered. >=20 > What does it mean to be subtracted? Perhaps 'removed'? Or are they = subject to arithmetic modification? >=20 >=20 >> Specifying new claims follows the baseline JWT procedures = ([RFC7519] >> Section 10.1). Note that understanding an extension as a verifier = is >> always optional for compliance with this specification (though = future >=20 > That's not a 'note'; that's a fundamental construct. It needs to be = stated much earlier and much more distinctly and as an explicitly = normative assertion. >=20 > Also, this seems to be the first reference to the verifier! >=20 > Also we need a description of the handling of a passport object in = terms of creation and consumption.) >=20 >=20 >> specifications or profiles for deployment environments may make = other >> "ppt" values mandatory). The creator of a PASSporT object cannot >> assume that verifiers will understand any given extension. = Verifiers >> that do support an extension may then trigger appropriate >> application-level behavior in the presence of an extension; authors >> of extensions should provide appropriate extension-specific = guidance >> to application developers on this point. >>=20 >> 5. Deterministic JSON Serialization >>=20 >> In order to provide a deterministic representation of the PASSporT >> Header and Claims, particularly if PASSporT is used across multiple >> signaling environments, the JSON header object and JSON Claim = object >> MUST be computed as follows. >=20 > The implication that there can be non-deterministic representations is > pretty odd and at least needs explanation, assuming the issue is real. >=20 >=20 >> The JSON object MUST follow the rules for the construction of the >> thumbprint of a JSON Web Key (JWK) as defined in [RFC7638] Section = 3. >> Each JSON object MUST contain no whitespace or line breaks before = or >> after any syntactic elements and with the required members ordered >> lexicographically by the Unicode [UNICODE] code points of the = member >> names. >=20 > mumble. >=20 >=20 >> In addition, the JSON header and claim members MUST follow the >> lexicographical ordering and character and string rules defined in >> [RFC7638] Section 3.3. >>=20 >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page = 9] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> 5.1. Example PASSport deterministic JSON form >>=20 >> For the example PASSporT Payload shown in Section 3.2.2.2, the >> following is the deterministic JSON object form. >>=20 >> {"dest":{"uri":["sip:alice@example.com"],"iat": = 1443208345,"mky" >> = :[{"alg":"sha-256","dig":"021ACC5427ABEB9C533F3E4B652E7D463F5442 >> = CD54F17A03A27DF9B07F4619B2"},{"alg":"sha-256","dig":"4AADB9B13F8 >> 2183B540212DF3E5D496B19E57CAB3E4B652E7D463F5442CD54F1"}], >> "orig":{"tn":"12155551212"}} >=20 > Perhaps explain the steps followed to produce this? Perhaps show the > intermediate forms? >=20 >=20 >=20 >> 6. Human Readability >>=20 >> JWT [RFC7519] and JWS [RFC7515] are defined to use Base64 and/or = UTF8 >> encoding to the Header, Payload, and Signature sections. However, >> many personal communications protocols, such as SIP and XMPP, use a >> "human readable" format to allow for ease of use and ease of >=20 > And email and FTP and HTTP and... >=20 > Actually the use of the form has nothing to do with the purpose of the > application. As noted, it merely makes debugging and monitoring = easier. >=20 >=20 >> operational debugging and monitoring. As such, specifications = using >> PASSporT may provide guidance on whether Base64 encoding or plain >> text will be used for the construction of the PASSporT Header and >> Claim sections. >=20 > The section is mislabeled and probably out of scope. It's trying to = say > there there can be alternative encodings of this json object and that > this spec won't prohibit that happening by other specs. >=20 > In all likelihood, this section should be removed. It doesn't specify > anything. >=20 >=20 >> 7. Security Considerations >>=20 >> 7.1. Avoidance of replay and cut and paste attacks >>=20 >> There are a number of security considerations for use of the token >=20 > I suspect they are not 'security considerations' as much as = 'mechanisms' or 'provisions' >=20 >=20 >> for avoidance of replay and cut and paste attacks. PASSporT tokens >> must be sent along with other application level protocol = information >=20 > Huh? You are trying to dictate application-level transport behavior? >=20 > This smacks of layer/scoping violation. >=20 >=20 >> (e.g. for SIP an INVITE as defined in [RFC3261]). There should be = a >> link between various information provided in the token and >> information provided by the application level protocol information. >=20 > Why? >=20 >=20 >> These would include: >>=20 >> o "iat" claim should closely correspond to a date/time the message >=20 > The semantics of iat are defined earlier. Either there is compliance = or > there isn't. The discussion here, therefore, should probably say > something like "a valid iat claim aids in detecting re-use at a later = time." >=20 >=20 >> was originated. It should also be within a relative delta time >=20 > What is a delta time? How is the reader to know? Where is it = defined? I suspect what is meant is that it's deviation from time of = origination should be small. If this has a more precise technical = definition, then cite it. >=20 >=20 >> that is reasonable for clock drift and transmission time >> characteristics associated with the application using the = PASSporT >> token. > > >> o "dest" claim is included to prevent the ability to use a >> previously originated message to send to another destination = party >=20 > the ability to -> using (or use of) >=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page = 10] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> 7.2. Solution Considerations >>=20 >> It should be recognized that the use of this token should not, in >> it's own right, be considered a full solution for absolute non- >> repudiation of the persona being asserted. This only provides non- >> repudiation of the signer of PASSporT. If the signer and the = persona >=20 > huh? So the originator isn't really being validated, as claimed??? >=20 >=20 >> are not one in the same, which can and often will be the case in >> telecommunications networks today, protecting the destination party >> from being spoofed may take some interpretation or additional >> verification of the link between the PASSporT signature and the >> persona being asserted. >>=20 >> In addition, the telecommunications systems and specifications that >> use PASSporT should in practice provide mechanisms for: >>=20 >> o Managing X.509 certificates and X.509 certificate chains to an >> authorized trust anchor that can be a trusted entity to all >> participants in the telecommunications network >=20 > Touching this sort of topic is, at the very best, redundant with > specifications devoted to X.509. Just cite them and don't attempt to > repeat them. >=20 >=20 >> o Accounting for entities that may route calls from other peer or >> interconnected telecommunications networks that are not part of >> the "trusted" communications network or may not be following the >> usage of PASSporT or the profile of PASSporT appropriate to that >> network >=20 > Passport doesn't do calls. Dictating activity involving calls is out = of scope. >=20 > On the other hand, perhaps this qualifies for a discussion about = transferring passport objects across administrative (trust) domain = boundaries? >=20 > At best, this section seems to be trying to compensate for the lack of = a framework discussion about the problem domain and the practical uses = of the various specifications being produced. >=20 >=20 >> o Following best practices around management and security of X.509 >> certificates >=20 > cf, above, about redundancies. Perhaps this is the bullet that should > remain, while deleting the other one? >=20 >=20 >> 7.3. Privacy Considerations >>=20 >> Because PASSporT explicity includes claims of identitifiers of >=20 > explicity -> explicitly >=20 > identitifiers -> identifiers >=20 >=20 >> parties involved in communications, times, and potentially other = call >> detail, care should be taken outside of traditional protected or >> private telephony communications paths where there may be concerns >> about exposing information to either unintended or illegitimately >> intented actors. These identifiers are often exposed through many >> communications signaling protocols as of today, but appropriate >> precautions should be taken. >=20 > intented -> intended >=20 >=20 > awk. >=20 > Illegitimately intended? What does that mean? >=20 > More fundamentally it isn't clear to me what this is really saying. >=20 >=20 >> 8. IANA Considerations >=20 > This section just sits here, uncited anywhere else in the document? = Each item specified should be referenced in the body of the main = specification, with a pointer into this section. >=20 >=20 >> 8.1. Media Type Registration >>=20 >> 8.1.1. Media Type Registry Contents Additions Requested >>=20 >> This section registers the "application/passport" media type >> [RFC2046] in the "Media Types" registry in the manner described in >>=20 >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page = 11] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> [RFC6838], which can be used to indicate that the content is a >> PASSporT defined JWT and JWS. >>=20 >> o Type name: application >>=20 >> o Subtype name: passport >>=20 >> o Required parameters: n/a >>=20 >> o Optional parameters: n/a >>=20 >> o Encoding considerations: 8bit; application/passport values = outside >> the US-ASCII range are encoded using percent encoding as = described >> in section 2.1 of RFC 3986 (some values may be the empty = string), >> each separated from the next by a single period ('.') character. >>=20 >> o Security considerations: See the Security Considerations section >> of RFC 7515. >>=20 >> o Interoperability considerations: n/a >>=20 >> o Published specification: draft-ietf-stir-passport-05 >>=20 >> o Applications that use this media type: STIR and other = applications >> that require identity related assertion >>=20 >> o Fragment identifier considerations: n/a >>=20 >> o Additional information: >>=20 >> * Magic number(s): n/a >>=20 >> * File extension(s): n/a >>=20 >> * Macintosh file type code(s): n/a >>=20 >> o Person and email address to contact for further information: = Chris >> Wendt, chris-ietf@chriswendt.net >>=20 >> o Intended usage: COMMON >>=20 >> o Restrictions on usage: none >>=20 >> o Author: Chris Wendt, chris-ietf@chriswendt.net >>=20 >> o Change Controller: IESG >>=20 >> o Provisional registration? No >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page = 12] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> 8.2. JSON Web Token Claims Registration >>=20 >> 8.2.1. Registry Contents Additions Requested >>=20 >> o Claim Name: "orig" >>=20 >> o Claim Description: Originating Identity String >>=20 >> o Change Controller: IESG >>=20 >> o Specification Document(s): Section 3.2 of draft-ietf-stir- >> passport-05 >>=20 >> o Claim Name: "dest" >>=20 >> o Claim Description: Destination Identity String >>=20 >> o Change Controller: IESG >>=20 >> o Specification Document(s): Section 3.2 of draft-ietf-stir- >> passport-05 >>=20 >> o Claim Name: "mky" >>=20 >> o Claim Description: Media Key Fingerprint String >>=20 >> o Change Controller: IESG >>=20 >> o Specification Document(s): Section 3.2 of draft-ietf-stir- >> passport-05 >>=20 >> 9. Acknowledgements >>=20 >> Particular thanks to members of the ATIS and SIP Forum NNI Task = Group >> including Jim McEchern, Martin Dolly, Richard Shockey, John = Barnhill, >> Christer Holmberg, Victor Pascual Avila, Mary Barnes, Eric Burger = for >> their review, ideas, and contributions also thanks to Henning >> Schulzrinne, Russ Housley, Alan Johnston, Richard Barnes, Mark >> Miller, and Ted Hardie for valuable feedback on the technical and >> security aspects of the document. Additional thanks to Harsha = Bellur >> for assistance in coding the example tokens. >>=20 >> 10. References >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page = 13] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> 10.1. Normative References >>=20 >> [I-D.ietf-stir-rfc4474bis] >> Peterson, J., Jennings, C., Rescorla, E., and C. Wendt, >> "Authenticated Identity Management in the Session >> Initiation Protocol (SIP)", = draft-ietf-stir-rfc4474bis-10 >> (work in progress), July 2016. >>=20 >> [RFC2046] Freed, N. and N. Borenstein, "Multipurpose Internet Mail >> Extensions (MIME) Part Two: Media Types", RFC 2046, >> DOI 10.17487/RFC2046, November 1996, >> . >>=20 >> [RFC3986] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform >> Resource Identifier (URI): Generic Syntax", STD 66, >> RFC 3986, DOI 10.17487/RFC3986, January 2005, >> . >>=20 >> [RFC6838] Freed, N., Klensin, J., and T. Hansen, "Media Type >> Specifications and Registration Procedures", BCP 13, >> RFC 6838, DOI 10.17487/RFC6838, January 2013, >> . >>=20 >> [RFC7515] Jones, M., Bradley, J., and N. Sakimura, "JSON Web >> Signature (JWS)", RFC 7515, DOI 10.17487/RFC7515, May >> 2015, . >>=20 >> [RFC7518] Jones, M., "JSON Web Algorithms (JWA)", RFC 7518, >> DOI 10.17487/RFC7518, May 2015, >> . >>=20 >> [RFC7519] Jones, M., Bradley, J., and N. Sakimura, "JSON Web Token >> (JWT)", RFC 7519, DOI 10.17487/RFC7519, May 2015, >> . >>=20 >> [RFC7638] Jones, M. and N. Sakimura, "JSON Web Key (JWK) >> Thumbprint", RFC 7638, DOI 10.17487/RFC7638, September >> 2015, . >>=20 >> [UNICODE] "The Unicode Consortium, "The Unicode Standard"", >> . >>=20 >> 10.2. Informative References >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page = 14] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> [RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, >> A., Peterson, J., Sparks, R., Handley, M., and E. >> Schooler, "SIP: Session Initiation Protocol", RFC 3261, >> DOI 10.17487/RFC3261, June 2002, >> . >>=20 >> [RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S., >> Housley, R., and W. Polk, "Internet X.509 Public Key >> Infrastructure Certificate and Certificate Revocation = List >> (CRL) Profile", RFC 5280, DOI 10.17487/RFC5280, May = 2008, >> . >>=20 >> [RFC7340] Peterson, J., Schulzrinne, H., and H. Tschofenig, = "Secure >> Telephone Identity Problem Statement and Requirements", >> RFC 7340, DOI 10.17487/RFC7340, September 2014, >> . >>=20 >> Appendix A. Example PASSporT JWS Serialization and Signature >>=20 >> For PASSporT, there will always be a JWS with the following = members: >>=20 >> o "protected", with the value BASE64URL(UTF8(JWS Protected = Header)) >>=20 >> o "payload", with the value BASE64URL (JWS Payload) >>=20 >> o "signature", with the value BASE64URL(JWS Signature) >>=20 >> Note: there will never be a JWS Unprotected Header for PASSporT. >>=20 >> First, an example PASSporT Protected Header is as follows: >>=20 >> { >> "typ":"passport", >> "alg":"ES256", >> "x5u":"https://cert.example.org/passport.cer" >> } >>=20 >> This would be serialized to the form: >>=20 >> = {"alg":"ES256","typ":"passport","x5u":"https://cert.example.org/ >> passport.cer"} >>=20 >> Encoding this with UTF8 and BASE64 encoding produces this value: >>=20 >> = eyJhbGciOiJFUzI1NiIsInR5cCI6InBhc3Nwb3J0IiwieDV1IjoiaHR0cHM6Ly9j >> ZXJ0LmV4YW1wbGUub3JnL3Bhc3Nwb3J0LmNlciJ9 >>=20 >> Second, an example PASSporT Payload is as follows: >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page = 15] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> { >> "dest":{"uri":["sip:alice@example.com"]} >> "iat":"1443208345", >> "orig":{"tn":"12155551212"} >> } >>=20 >> This would be serialized to the form: >>=20 >> {"dest":{"uri":["sip:alice@example.com"]},"iat":"1443208345", >> "orig":{"tn":"12155551212"}} >>=20 >> Encoding this with the UTF8 and BASE64 encoding produces this = value: >>=20 >> eyJkZXN0Ijp7InVyaSI6WyJzaXA6YWxpY2VAZXhhbXBsZS5jb20iXX0sImlhd >> CI6IjE0NDMyMDgzNDUiLCJvcmlnIjp7InRuIjoiMTIxNTU1NTEyMTIifX0 >>=20 >> Computing the digital signature of the PASSporT Signing Input >> ASCII(BASE64URL(UTF8(JWS Protected Header)) || '.' || BASE64URL(JWS >> Payload)) >>=20 >> rq3pjT1hoRwakEGjHCnWSwUnshd0-zJ6F1VOgFWSjHBr8Qjpjlk-cpFYpFYso >> jNCpTzO3QfPOlckGaS6hEck7w >>=20 >> The final PASSporT token is produced by concatenating the values in >> the order Header.Payload.Signature with period (',') characters. = For >> the above example values this would produce the following: >>=20 >> eyJhbGciOiJFUzI1NiIsInR5cCI6InBhc3Nwb3J0IiwieDV1IjoiaHR0cHM6Ly >> 9jZXJ0LmV4YW1wbGUub3JnL3Bhc3Nwb3J0LmNlciJ9 >> . >> eyJkZXN0Ijp7InVyaSI6WyJzaXA6YWxpY2VAZXhhbXBsZS5jb20iXX0sImlhd >> CI6IjE0NDMyMDgzNDUiLCJvcmlnIjp7InRuIjoiMTIxNTU1NTEyMTIifX0 >> . >> rq3pjT1hoRwakEGjHCnWSwUnshd0-zJ6F1VOgFWSjHBr8Qjpjlk-cpFYpFYso >> jNCpTzO3QfPOlckGaS6hEck7w >>=20 >> A.1. X.509 Private Key Certificate for Example >>=20 >> -----BEGIN EC PRIVATE KEY----- >> = MHcCAQEEIFeZ1R208QCvcu5GuYyMfG4W7sH4m99/7eHSDLpdYllFoAoGCCqGSM49 >> = AwEHoUQDQgAE8HNbQd/TmvCKwPKHkMF9fScavGeH78YTU8qLS8I5HLHSSmlATLcs >> lQMhNC/OhlWBYC626nIlo7XeebYS7Sb37g=3D=3D >> -----END EC PRIVATE KEY----- >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page = 16] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> A.2. X.509 Public Key Certificate for Example >>=20 >> -----BEGIN PUBLIC KEY----- >> = MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE8HNbQd/TmvCKwPKHkMF9fScavGeH >> 78YTU8qLS8I5HLHSSmlATLcslQMhNC/OhlWBYC626nIlo7XeebYS7Sb37g=3D=3D >> -----END PUBLIC KEY----- >>=20 >> Authors' Addresses >>=20 >> Chris Wendt >> Comcast >> One Comcast Center >> Philadelphia, PA 19103 >> USA >>=20 >> Email: chris-ietf@chriswendt.net >>=20 >>=20 >> Jon Peterson >> Neustar Inc. >> 1800 Sutter St Suite 570 >> Concord, CA 94520 >> US >>=20 >> Email: jon.peterson@neustar.biz >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page = 17] >=20 > -- >=20 > Dave Crocker > Brandenburg InternetWorking > bbiw.net >=20 > -- >=20 > Dave Crocker > Brandenburg InternetWorking > bbiw.net >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir --Apple-Mail=_F3E4A68D-098D-4B4C-AFA8-46D70D4C1CDF Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQIcBAEBCAAGBQJXm2C+AAoJEORoZaSQsc1IUSsP/jpvz4IZ6Zae8keR2F3edNC2 sN5mpqXYFZ8o2VFk7C9ChWEDVEIjelHcqBwbVszLaHf/ag0Hy1VzzfDYDTkuBONT BnYEscSedcQsb7TsEXF96m3BgoVzcdiRx6LC4QRhPbw2SWJrKfPJMLvgJ5P03ndk Ri3jskV7KkbM+pNE0lnXQMO3xHzcRCEdC/t1S7aQCx7nTe+VUmVQfWtosLbVCW/V QNqvTALzLAsHOlkTAJ//7cGAv2RSlw9OdEgX70z9X3BUWn/jPspkSdujLNbI8u4s cOPahjpqYIGekaaKEpGwzkdBIHv4pAgyjtuuyQ8+Ja8FCGnHs+X/9Q7RJCMwLveN OXiDVOHgWJcSjItRN8DRwHaUkLFgBhmLxic6ADXFeFFru6oAYWRki3LzDAk6ABjS p5CwsOGCu5q/5UVDhjlA0ArppprifVlhEfHQGkWoCGNI4CsNcxpTzvgyHdWIUlU7 C59Xadb/wiMUaXMQieJV5OG63rPBreo3deDx1EP4V9fMWgfMc7EPMtn3SmDKIYta c06CQK4Hwjy7zLxzvJbhFq+YXnH3cFW7DqGBBxxG3VFGUKIBmehQyYmuWPnwnEDS unfZbHS9wOvBTiUQwoLUjv9Sosg3lkOm0cQHaPEalsKIsmgxr/ZtaAGr+ibFMkgO 2W940/0cb7FvppaYpU2f =dDhc -----END PGP SIGNATURE----- --Apple-Mail=_F3E4A68D-098D-4B4C-AFA8-46D70D4C1CDF-- From nobody Fri Jul 29 07:23:29 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E1CC412D6B5 for ; Fri, 29 Jul 2016 07:23:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.107 X-Spam-Level: X-Spam-Status: No, score=-1.107 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RDNS_NONE=0.793] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MoAK1ehw8raI for ; Fri, 29 Jul 2016 07:23:27 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 26F6B12D0F1 for ; Fri, 29 Jul 2016 07:23:27 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u6TEOAwt013031 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Fri, 29 Jul 2016 07:24:11 -0700 To: Eric Burger References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <7cf45386-60a3-6b5e-de1a-a9ca2d9c1c01@dcrocker.net> Date: Fri, 29 Jul 2016 07:23:19 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Review of: draft-ietf-stir-passport-05 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Jul 2016 14:23:28 -0000 Eric, Thanks for the quick response. On 7/29/2016 6:57 AM, Eric Burger wrote:> > Dave - Thanks for the review. I agree with a lot of your meta points, > most especially that a major revision during last call that makes > some not insubstantial syntactic changes is unusual, to say the FWIW there also were not insubstantial semantic changes, by my reading. > Another thing that perhaps we need to put into the document suite > relates to your comment about certificate management. In a normal, > interoperable protocol one would have a single certificate management > mechanism that everybody agrees to. The problem is the approach used > for certificate management in the case of STIR/PASSporT is directly > an embodiment of policy. Because the target audience for the protocol > is (today) highly regulated with differing national policies and > policy bodies, it is just not possible to mandate a particular > certificate policy (i.e., your comment about key rollover and one I > think you obliquely touched upon, what is the Subject of the key > doing the signing). You appear to be saying that the actual use of this for SIP is going to vary according to a wide variety of policies. If this means a variety of independent services, that's fine, of course. If this means a variety of services that are supposed to interoperate, it's not. So forgive me, but how does that provide the end-to-end authentication service that is the primary goal of this working group and that will be credible? > The WG is producing a straw proposal that would > provide some semblance of a baseline, but it is not clear there will > be more than one or two implementations of that policy. cf, preceding question. > All this said, I will also defend the document in that (admittedly > with assistance from me and Chris Wendt) an undergraduate student > coded a STIR authentication service and STIR validation service in > under a year, I've no doubt that someone could take this specification and produce code based on their reading of it. People do that with incomplete specifications all the time. The question is how much they had to fill in gaps and whether the next reader would fill in the same gaps in the same way and produce an interoperable implementation? By my reading, that's a very low probability outcome... d/ ps. (Just in case I missed text from you: I don't see any comments from you in the remainder of your message. Only a copy of the message I sent.) -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Fri Jul 29 08:22:27 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0A85412D7CE for ; Fri, 29 Jul 2016 08:22:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (768-bit key) header.d=shockey.us Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kVrn0ozK84u7 for ; Fri, 29 Jul 2016 08:22:21 -0700 (PDT) Received: from qproxy2.mail.unifiedlayer.com (qproxy2-pub.mail.unifiedlayer.com [69.89.16.161]) by ietfa.amsl.com (Postfix) with SMTP id 5082912D7B9 for ; Fri, 29 Jul 2016 08:22:21 -0700 (PDT) Received: (qmail 5842 invoked by uid 0); 29 Jul 2016 15:22:21 -0000 Received: from unknown (HELO cmgw4) (10.0.90.85) by qproxy2.mail.unifiedlayer.com with SMTP; 29 Jul 2016 15:22:21 -0000 Received: from box462.bluehost.com ([74.220.219.62]) by cmgw4 with id QfHH1t00z1MNPNq01fHLV5; Fri, 29 Jul 2016 09:17:21 -0600 X-Authority-Analysis: v=2.1 cv=TIHWFTVa c=1 sm=1 tr=0 a=jTEj1adHphCQ5SwrTAOQMg==:117 a=jTEj1adHphCQ5SwrTAOQMg==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=MKtGQD3n3ToA:10 a=1oJP67jkp3AA:10 a=ZZnuYtJkoWoA:10 a=8WrITzYgnNwA:10 a=fGh7L_e3oJcA:10 a=cAmyUtKerLwA:10 a=jqBRFv0mrdUA:10 a=ll-iCDY8AAAA:8 a=M0OflfRGAAAA:8 a=48vgC7mUAAAA:8 a=bfLuiRfvAAAA:8 a=b8OvNEjoAAAA:8 a=k7Ga1wGzAAAA:8 a=QIhr-27iAAAA:8 a=A1X0JdhQAAAA:8 a=OK-8mIdLAAAA:8 a=w1VtefKfAAAA:8 a=BqEg4_3jAAAA:8 a=te1EGT4yAAAA:8 a=hGBaWAWWAAAA:8 a=j3KBwUUykvmMDco11j4A:9 a=s7mIsmLnb8Pjo0XS:21 a=aOAOlDWCWIJXIxVA:21 a=HUtTbxLCBLrc1sDa:21 a=QEXdDO2ut3YA:10 a=ivbTfD_dPm4A:10 a=NWVoK91CQySWRX1oVYDe:22 a=VpyrLIdO_Ztbr3SWPBuH:22 a=6yl0mh0s51TKORVA8GqK:22 a=w1C3t2QeGrPiZgrLijVG:22 a=u7KogQI6p9ntt2sFUKYF:22 a=xfJ8-ueq0pyqlCF7aVox:22 a=ijMaxGghyylP-n2pFjDB:22 a=cgaYBWEFosGJW4rWv5Lf:22 a=Df3jFdWbhGDLdZNm0fyq:22 a=bPPIUcp-n4lFe3GeRkWd:22 a=xm8PXHvXF9WL09pmvKgj:22 a=0mFWnFbQd5xWBqmg7tTt:22 a=RRElR4r2U1jGY2dU47NL:22 a=Q-ofuW86YyylptHqTH-7:22 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=shockey.us; s=default; h=Content-transfer-encoding:Content-type:Mime-version:In-Reply-To :References:Message-ID:CC:To:From:Subject:Date; bh=+um/d1ZbeLlzU3jk2s8U14uq9vEw65HTA+RZh5zEdN0=; b=NCP61CsTDeUcZ/Gbem4ZWANH9c KdYNF1b/7e/4RHsIPLUU+AC0vfuUc78JNKzuo60rMLSJUQhKoPzLAuc/qxPIr/ZSdUyGnWzI5SEo/ zL8w7f4URQ1FeyhL/zTbXrTDG; Received: from [100.36.21.178] (port=49416 helo=[192.168.1.152]) by box462.bluehost.com with esmtpa (Exim 4.86_2) (envelope-from ) id 1bT9XJ-0004ye-8S; Fri, 29 Jul 2016 09:17:17 -0600 User-Agent: Microsoft-MacOutlook/f.18.0.160709 Date: Fri, 29 Jul 2016 11:17:00 -0400 From: Richard Shockey To: Eric Burger , Crocker Dave Message-ID: <4C7B58CB-3859-4ED3-97BF-F9E3EF880523@shockey.us> Thread-Topic: [stir] Review of: draft-ietf-stir-passport-05 References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> In-Reply-To: Mime-version: 1.0 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable X-Identified-User: {3286:box462.bluehost.com:shockeyu:shockey.us} {sentby:smtp auth 100.36.21.178 authed with richard+shockey.us} X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box462.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - shockey.us X-Source-IP: 100.36.21.178 X-Exim-ID: 1bT9XJ-0004ye-8S X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: ([192.168.1.152]) [100.36.21.178]:49416 X-Source-Auth: richard+shockey.us X-Email-Count: 0 X-Source-Cap: c2hvY2tleXU7c2hvY2tleXU7Ym94NDYyLmJsdWVob3N0LmNvbQ== Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Review of: draft-ietf-stir-passport-05 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Jul 2016 15:22:27 -0000 +1=20 In general, I agree with Eric=E2=80=99s general characterization of the current s= tatus of STIR etc. As to the points Eric makes first yes there are use cas= es for STIR passport that frankly some of us do not want to go into extensiv= e detail on. Some of those are ones directly related to public safety issues= and the validated identity of the calling party. I do NOT believe we need t= ext on those issues. Silence is often golden. On the second point Eric is entirely correct that the issues of certificate= /key management are strictly in the domain of national/industry policy re E.= 164 and as such have no business in the IETF whatsoever. We will deal with = those issues in other bodies as deemed appropriate. I could say some things about MODERN diving into policy issues but I won=E2=80=99= t. You can listen to the WG meeting for my views on that. Along with Eric, silence on the existing set of documents in LC is, for now= , acceptance. =20 =E2=80=94=20 Richard Shockey Shockey Consulting LLC Chairman of the Board SIP Forum www.shockey.us www.sipforum.org richardshockey.us Skype-Linkedin-Facebook rshockey101 PSTN +1 703-593-2683 On 7/29/16, 9:57 AM, "stir on behalf of Eric Burger" wrote: Dave - Thanks for the review. I agree with a lot of your meta points, most esp= ecially that a major revision during last call that makes some not insubstan= tial syntactic changes is unusual, to say the least, especially as there has= been no list discussion on the changes. That said, it is my belief that for= once, in this case silence is acceptance. Just so it=E2=80=99s on the list, my si= lence was acceptance (although grumbling acceptance because the changes blew= up my implementation and for personal reasons I won=E2=80=99t be able to try to i= mplement the new stuff until September). =20 Let me attempt to defend one thing that I agree should have some attach= ed text to resolve. There *are* STIR use cases extant that use the mechanism= beyond PASSporT. However, *none* of them are appropriate for work in the IE= TF. If some of the folks who are on this list that are doing that work would= would not mind opening the curtain just a tiny bit, that could allay fears = that we are doing generalization and extension for generalization and extens= ion=E2=80=99s sake. =20 Another thing that perhaps we need to put into the document suite relat= es to your comment about certificate management. In a normal, interoperable = protocol one would have a single certificate management mechanism that every= body agrees to. The problem is the approach used for certificate management = in the case of STIR/PASSporT is directly an embodiment of policy. Because th= e target audience for the protocol is (today) highly regulated with differin= g national policies and policy bodies, it is just not possible to mandate a = particular certificate policy (i.e., your comment about key rollover and one= I think you obliquely touched upon, what is the Subject of the key doing th= e signing). The WG is producing a straw proposal that would provide some sem= blance of a baseline, but it is not clear there will be more than one or two= implementations of that policy. =20 All this said, I will also defend the document in that (admittedly with= assistance from me and Chris Wendt) an undergraduate student coded a STIR a= uthentication service and STIR validation service in under a year, with the = challenge of a very a high velocity of dramatic changes (as opposed to the m= odest syntactic changes that just occurred in the last draft), says the docu= ment is not totally hopeless. =20 - Eric =20 =20 > On Jul 28, 2016, at 1:37 PM, Dave Crocker wrote: >=20 >=20 >=20 > Review of: draft-ietf-stir-passport-05 > Date: 27 July 2016 > Revied by: D. Crocker >=20 >=20 > Summary: >=20 > The 'Persona Assertion Token' specification defines an object contain= ing > multiple attributes that are intended to be used for authentication, > integrity and non-repudiation, such as validating the originator of a > SIP telephone call. The object is intended to be application- and > transport-independent. In effect, the object links certification deta= ils > to application details and/or transport details. >=20 > Although the text provides details of 'how' to compose a passport tok= en, > it never actually says what passport is. There are some later comment= s > that imply what it is, or seem to assume a knowledge of what it is, b= ut > it's never defined as a technical construct. By way of example, how d= oes > it differ from the function of an X.509 cert? >=20 > The specification has problems with its explanation of purpose and it= s > apparent scope, as well as occasional lack of clarity or > correctness. It even has quite a few typographical errors that would > have been trivially detected by a spelling corrector. >=20 > The document was only first produced in February, with 4 revisions in > the last 3 months, including one during Last Call. And the recent > revisions have included quite substantive changes. Discussion about t= he > draft on the wg mailing list has been thin. Also, during the wg sessi= on > in Berlin, discussion seemed to include a fair amount of reference to > what 'might' be done -- eg, tailoring use through profiles or encodin= g > for SIP or... -- rather than clarity about how this specification wou= ld > definitely be used. It suggests the possibility of less stability in > community understanding of the specification than one would wish for = an > IETF proposed standard. >=20 > The document is /not/ ready for publication. >=20 >=20 >=20 > This appears to be a specification for something that is for far more > general use than simply doing caller-id authentication; as such it > appears to go beyond the scope of the working group's charter. This > might be acceptable, if the solution provided adequately covered what > /is/ in scope and were still timely and sufficiently 'efficient'. How= ever the working group has taken 3 years to produce this work and there are = no other use-cases presented and no other specifications for use, to justify= the purported generality. As such, the generality is purely theoretical. Wo= rse, there is a poor track-record of such efforts proving successful at bein= g more general. Instead, they impose the overhead of generality without the = benefit. >=20 > The document is written with the apparent expectation that the reader > has quite a bit of prior knowledge but it isn't stated explicitly. Th= is > needs to be written for a wider audience than just those already in t= he > wg and more than those already familiar with the work. If there are > specific details the reader must know ahead of time, state or cite th= em > early and explicitly >=20 > As an example, the document is really built on top of JWT but doesn't > introduce the reference or details about this until section 3. (The > passing reference in section 2 does not explain that JWT is foundatio= nal > to the current work.) >=20 > As to the choice of JWT, it seems odd, since it isn't natural to the = SIP context, which is essential for the chartered work, and therefore requir= es an additional layer of translation for use with SIP. >=20 > The document title and the content use the term 'persona' but there i= s > nothing in this document that pertains to any of the normal, technica= l > -- or even informal -- uses of the term. So it might be a clever turn= of > phrase, but it appears to be significantly inappropriate, or at least > misleading. (Perhaps the goal is to sustain the unusual choices that = SIP > made, such as with the term 'identity', deviating from usages in the > world of online identity?...) >=20 > The document desperately needs a carefully-written terminology sectio= n. >=20 > The specification is dominated by heavy focus on the details and > mechanisms, without much that covers purposes and functions. The text= is > heavy with redundant acronyms usage, to the point of distraction. > (Imagine specifying http by having every paragraph say that ASCII (or > Unicode or whatever) is being used. Assert packaging-related details > only where needed, rather than feeling that every bit of technical > information must be seasoned with references to JWT, JWS, or whatever= . >=20 > Algorithmic details often are specified in non-linear sequence, eg, i= f B > do C after doing A and before doing C. This makes it difficult to > acquire an simple understanding of the sequence. Algorithms need to b= e > presented in as linear a fashion as possible, and preferable include > pseudo-code, to be that much more concise. >=20 > In terms of pragmatics, here are two operational questions that I can= 't > answer, based on this specification, and yet they are fundamental to = the > utility of this work. >=20 > How is key rollover done? >=20 > How is delegation done, such as for use by authorized third > parties? >=20 > As an example that the document needs much more careful proofreading, > the terms header and headers appear to be used inconsistently and > possibly incorrectly. >=20 > Also I note that a revision of the draft was posted during Last Call. > This can create confusion or extra work, to reconcile things. From a > quick scan of the revision's diff, it doesn't appear that the changes > affect this review... maybe. >=20 > Also, having a Last Call that overlaps with an IETF meeting is not a > good way to encourage adequate attention to the production of reviews= , > although the document really needed them. >=20 >=20 >=20 >=20 >=20 > Detailed Comments > ----------------- >=20 >=20 >> STIR C. W= endt >> Internet-Draft Com= cast >> Intended status: Standards Track J. Pete= rson >> Expires: January 23, 2017 Neustar = Inc. >> July 22, 2= 016 >>=20 >>=20 >> Persona Assertion Token >> draft-ietf-stir-passport-05 >>=20 >> Abstract >>=20 >> This document defines a token format for verifying with non- >=20 > [format] remove or remove [token] >=20 > Is the timestamp the basis of claiming non-repudiation? >=20 >=20 >> repudiation the sender of and authorization to send information >> related to the originator of personal communications. A >=20 > 'info related to'... what does this mean? >=20 >=20 >> cryptographic signature is defined to protect the integrity of the >> information used to identify the originator of a personal >> communications session (e.g. the telephone number or URI) and veri= fy >> the accuracy of this information at the destination. The >=20 > 'accuracy'? validates authorship, not validity, I suspect. >=20 > A signature's primary purpose usually is authenticate origination, au= thorship, or the like, where integrity is a side-effect of the methodology. = Integrity as the primary function would typically occur only when the ident= ity of the signer need be no more than something like 'whomever I interacted= with previously'. I suspect that such a session-limited identity semantic = is not, in fact, the intent here. >=20 >=20 >> cryptographic signature is defined with the intention that it can >> confidently verify the originating persona even when the signature= is >> sent to the destination party over an unsecure channel. The Perso= na >=20 > unsecure -> insecure (unless the intend is reference to a loan?) >=20 >=20 >> Assertion Token (PASSporT) is particularly useful for many persona= l >> communications applications over IP networks and other multi-hop >> interconnection scenarios where the originating and destination >> parties may not have a direct trusted relationship. >>=20 >> Status of This Memo >>=20 >> This Internet-Draft is submitted in full conformance with the >> provisions of BCP 78 and BCP 79. >>=20 >> Internet-Drafts are working documents of the Internet Engineering >> Task Force (IETF). Note that other groups may also distribute >> working documents as Internet-Drafts. The list of current Interne= t- >> Drafts is at http://datatracker.ietf.org/drafts/current/. >>=20 >> Internet-Drafts are draft documents valid for a maximum of six mon= ths >> and may be updated, replaced, or obsoleted by other documents at a= ny >> time. It is inappropriate to use Internet-Drafts as reference >> material or to cite them other than as "work in progress." >>=20 >> This Internet-Draft will expire on January 23, 2017. >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Pag= e 1] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> Copyright Notice >>=20 >> Copyright (c) 2016 IETF Trust and the persons identified as the >> document authors. All rights reserved. >>=20 >> This document is subject to BCP 78 and the IETF Trust's Legal >> Provisions Relating to IETF Documents >> (http://trustee.ietf.org/license-info) in effect on the date of >> publication of this document. Please review these documents >> carefully, as they describe your rights and restrictions with resp= ect >> to this document. Code Components extracted from this document mu= st >> include Simplified BSD License text as described in Section 4.e of >> the Trust Legal Provisions and are provided without warranty as >> described in the Simplified BSD License. >>=20 >> Table of Contents >>=20 >> 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . = 3 >> 2. Token Overview . . . . . . . . . . . . . . . . . . . . . . . = 4 >> 3. PASSporT Definition . . . . . . . . . . . . . . . . . . . . . = 4 >> 3.1. PASSporT Header . . . . . . . . . . . . . . . . . . . . . = 4 >> 3.1.1. "typ" (Type) Header Parameter . . . . . . . . . . . . = 4 >> 3.1.2. "alg" (Algorithm) Header Parameter . . . . . . . . . = 5 >> 3.1.3. "x5u" (X.509 URL) Header Parameter . . . . . . . . . = 5 >> 3.2. PASSporT Payload . . . . . . . . . . . . . . . . . . . . = 5 >> 3.2.1. JWT defined claims . . . . . . . . . . . . . . . . . = 5 >> 3.2.1.1. "iat" - Issued at claim . . . . . . . . . . . . . = 5 >> 3.2.2. PASSporT specific claims . . . . . . . . . . . . . . = 6 >> 3.2.2.1. Originating and Destination Identity Claims . . . = 6 >> 3.2.2.2. "mky" - Media Key claim . . . . . . . . . . . . . = 7 >> 3.3. PASSporT Signature . . . . . . . . . . . . . . . . . . . = 8 >> 4. Extending PASSporT . . . . . . . . . . . . . . . . . . . . . = 8 >> 4.1. "ppt" (PASSporT) header parameter . . . . . . . . . . . . = 8 >> 4.2. Extended PASSporT Claims . . . . . . . . . . . . . . . . = 9 >> 5. Deterministic JSON Serialization . . . . . . . . . . . . . . = 9 >> 5.1. Example PASSport deterministic JSON form . . . . . . . . = 10 >> 6. Human Readability . . . . . . . . . . . . . . . . . . . . . . = 10 >> 7. Security Considerations . . . . . . . . . . . . . . . . . . . = 10 >> 7.1. Avoidance of replay and cut and paste attacks . . . . . . = 10 >> 7.2. Solution Considerations . . . . . . . . . . . . . . . . . = 11 >> 7.3. Privacy Considerations . . . . . . . . . . . . . . . . . = 11 >> 8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . = 11 >> 8.1. Media Type Registration . . . . . . . . . . . . . . . . . = 11 >> 8.1.1. Media Type Registry Contents Additions Requested . . = 11 >> 8.2. JSON Web Token Claims Registration . . . . . . . . . . . = 13 >> 8.2.1. Registry Contents Additions Requested . . . . . . . . = 13 >> 9. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . = 13 >> 10. References . . . . . . . . . . . . . . . . . . . . . . . . . = 13 >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Pag= e 2] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> 10.1. Normative References . . . . . . . . . . . . . . . . . . = 14 >> 10.2. Informative References . . . . . . . . . . . . . . . . . = 14 >> Appendix A. Example PASSporT JWS Serialization and Signature . . = 15 >> A.1. X.509 Private Key Certificate for Example . . . . . . . . = 16 >> A.2. X.509 Public Key Certificate for Example . . . . . . . . = 17 >> Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . = 17 >>=20 >> 1. Introduction >>=20 >> In today's IP-enabled telecommunications world, there is a growing >> concern about the ability to trust incoming invitations for >> communications sessions, including video, voice and messaging. >> [RFC7340] As an example, modern telephone networks provide the >> ability to spoof the calling party telephone number for many >> legitimate purposes including providing network features and servi= ces >> on the behalf of a legitimate telephone number. However, as we ha= ve >> seen, bad actors have taken advantage of this ability for >> illegitimate and fraudulent purposes meant to trick telephone user= s >> to believe they are someone they are not. This problem can be >> extended to many emerging forms of personal communications. >>=20 >> This document defines a common method for creating and validating = a >=20 > [common] delete >=20 >=20 >> token that cryptographically verifies an originating identity, or >> more generally a URI or application specific identity string >=20 > 'identity string'? what does this mean? >=20 > 'app string id'? what does this mean? >=20 >=20 >> representing the originator of personal communications. Through >> extended profiles other information relevant to the personal >> communications can also be attached to the token. The primary goa= l >> of PASSporT is to provide a common framework for signing persona >=20 > What is a 'persona'? Where is this construct introduced or cited and= explained? >=20 > 'profiles'? Where is this construct introduced or cited and explaine= d? >=20 >=20 >> related information in an extensible way. A secondary goal is to >=20 > It seems to also be primary. >=20 > (PPT provides a framework for signing related information) ? >=20 >=20 >> provide this functionality independent of any specific personal >> communications signaling call logic, so that creation and >> verification of persona information can be implemented in a flexib= le >> way and can be used in many personal communications applications >> including end-to-end applications that require different signaling >> protocols. It is anticipated that signaling protocol specific >> guidance will be provided in other related documents and >> specifications to specify how to use and transport PASSporT tokens= , >=20 > specs to spec... awkward phrasing >=20 > as always, a specification that declares what is 'anticipated' moves = into purely hypothetical, which too-often proves to be wishful fantasy. The = reference doesn't specify anything and it creates a dependency that well mig= ht not be satisfied. >=20 > 'tokens'? Where is this constructed introduced, cited or explained? = Use of a term like this implies that there is some distinctive meaning, but = really there isn't. This is a format specification. That's all. >=20 > If there is a claim that the term token does have significance here, = then please explain it. For example, how is this token to be used? >=20 > If the term is used merely as an inheritance from JWT, then cite that= early, to justify the term. >=20 >=20 >> however this is intentionally out of scope for this document. >>=20 >> Note: As of the authoring of this document, >> [I-D.ietf-stir-rfc4474bis] provides details of how to use PASSporT >> within SIP signaling for the signing and verification of telephone >> numbers. >=20 > remove Note. Or make it a note to RFC Editor to remove it, or rephra= se so it's useful 10 years from now. >=20 >=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Pag= e 3] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> 2. Token Overview >>=20 >> Tokens are a convenient way of encapsulating information with >=20 > Why? What are the alternatives? Why is this the starting point? >=20 >=20 >> associated digital signatures. They are used in many applications >=20 > Such as? >=20 > Anyhow, this section seems to take the construct of 'token' as being = an established term of art. It isn't. Or, at least, I've no idea what is m= eant here that distinguishes a token from anything else, such as other forms= of encapsulation. Say/cite what a token is, if it is such a distinctive th= ing. Say/cite how it differs from alternatives, if its superiority is going= to be touted. >=20 >=20 >> that require authentication, authorization, encryption, non- >> repudiation and other use cases. JSON Web Token (JWT) [RFC7519] a= nd >> JSON Web Signature (JWS) [RFC7515] are designed to provide a compa= ct >> form for many of these purposes and define a specific method and >> syntax for signing a specific set of information or "claims" withi= n >> the token and therefore providing an extensible set of claims. >> Additionally, JWS provides extensible mechanisms for specifying th= e >> method and cryptographic algorithms used for the associated digita= l >> signatures. >=20 > Note that there is nothing in the above text that actually explains w= hat a token is or how it differs from things that aren't tokens. >=20 >=20 >> 3. PASSporT Definition >=20 > This section is not a definition. It's more like structure, or forma= t, or foundation or encoding. >=20 >=20 >> The PASSporT is constructed based on JWT [RFC7519] and JWS [RFC751= 5] >> specifications. JWS defines the use of JSON data structures in a >> specified canonical format for signing data corresponding to JOSE >> header, JWS Payload, and JWS Signature. JWT defines specific set = of >=20 > specific set -> a set >=20 >=20 >> claims that are represented by specified key value pairs which can= be >> extended with custom keys for specific applications. >>=20 >> 3.1. PASSporT Header >>=20 >> The JWS token header is a JOSE header [RFC7515] that defines the t= ype >> and encryption algorithm used in the token. >=20 > The section starts with structure detail and ends with purpose. This = should be swapped. >=20 >=20 >> An example of the header for the case of an ECDSA P-256 digital >> signature would be the following, >=20 > How is reader to know what that long string means? Is the doc only fo= r > the cognoscenti? if so, which cognoscenti? >=20 >=20 >> { >> "typ":"passport", >> "alg":"ES256", >> "x5u":"https://cert.example.org/passport.cer" >> } >=20 > *** EXPLAIN EXAMPLES, PLEASE *** >=20 >=20 >> 3.1.1. "typ" (Type) Header Parameter >>=20 >> JWS defines the "typ" (Type) Header Parameter to declare the media >> type of the JWS. >=20 > media type? IANA citation needed. (It was in an earlier version of = the draft!) >=20 >=20 >> For PASSporT Token the "typ" header MUST minimally include and beg= in >> with "passport". This represents that the encoded token is a JWT = of >> type passport. >=20 > Is it possible to begin with it and not include it? That is, 'includ= e' is redundant. 'minimally' is also not information, but it raises the que= stion: The other two attributes aren't required??? >=20 > Also, this subsection is part of an Overview. Why does it have norma= tive content? Or is this not really an overview? >=20 >=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Pag= e 4] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> 3.1.2. "alg" (Algorithm) Header Parameter >>=20 >> For PASSporT, the "alg" should be defined as follows, for the >> creation and verification of PASSporT tokens and their digital >> signatures ES256 MUST be implemented. >>=20 >> Note that JWA [RFC7518] defines other algorithms that may be utili= zed >> or updated in the future depending on cryptographic strength >> requirements guided by current security best practice. >>=20 >> 3.1.3. "x5u" (X.509 URL) Header Parameter >>=20 >> As defined in JWS, the "x5u" header parameter is used to provide a >> URI [RFC3986] referring to the resource for the X.509 public key >> certificate or certificate chain [RFC5280] corresponding to the ke= y >=20 > So this service uses a classic X.509 authentication hierarchy? That'= s a key design point, only mentioned in a third-level section. >=20 >=20 >> used to digitally sign the JWS. Note: The definition of what the = URI >> represents in terms of the actor serving the X.509 public key is o= ut >=20 > 'actor serving the X.509 public key' ? what does that mean? >=20 >=20 >> of scope of this document. However, generally this would correspo= nd >> to an HTTPS or DNSSEC resource with the guidance that it MUST be a >=20 > [a] remove >=20 >=20 >> TLS protected, per JWS spec. >=20 > This /object/ specification (that is transport independent) dictates = /transport/ security??? This is probably wrong, but at least needs careful = explanation. >=20 >=20 >>=20 >> 3.2. PASSporT Payload >>=20 >> The token payload claims should consist of the information which >=20 > [payload] remove; at best it's redundant >=20 > 'should'? not MUST? why? >=20 >> needs to be verified at the destination party. This claim should >> correspond to a JWT claim [RFC7519] and be encoded as defined by t= he >> JWS Payload [RFC7515] >=20 > should? why >=20 > correspond??? what does that mean, in technical terms? >=20 >=20 >> The PASSporT defines the use of a number of standard JWT defined >=20 > "The PASSporT" is an affectation. Both the 'the' and the use of case= . >=20 >=20 >> headers as well as two new custom headers corresponding to the two >=20 > header/s/? >=20 > corresponding? referring? describing? identifying? addressing? >=20 >=20 >> parties associated with personal communications, the originator an= d >> terminator. These headers or key value pairs are detailed below. >=20 > These headers or key value pairs are -> This information is >=20 >=20 >> Key values outside the US-ASCII range should be encoded using perc= ent >> encoding as described in section 2.1 of RFC 3986, case normalized = as >> described in 6.2.2.1 of [RFC3986]. Matching of these values shoul= d >> use string exact match. >>=20 >> 3.2.1. JWT defined claims >=20 > When something like this is imported from another spec, there needs t= o > be a precise pointer to the specific part of the spec defining it. >=20 >=20 >> 3.2.1.1. "iat" - Issued at claim >>=20 >> The JSON claim MUST include the "iat" [RFC7519] defined claim issu= ed >> at. As defined this should be set to a date cooresponding to the >=20 > issued at -> "Issued At". >=20 > It would be better to explicitly cite section 4.1.6 in that RFC. Read= ers should not have to search an entire document to find the detail being re= ferenced. >=20 > Also, note the MUST here. I suspect this conflicts with the normativ= e language above in the 'overview'. >=20 >=20 >> origination of the personal communications. The time value should= be >> of the format defined in [RFC7519] Section 2 NumericDate. This is >> included for securing the token against replay and cut and paste >>=20 >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Pag= e 5] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> attacks, as explained further in the security considerations in >> section 7. >>=20 >> 3.2.2. PASSporT specific claims >>=20 >> 3.2.2.1. Originating and Destination Identity Claims >>=20 >> Baseline PASSporT defines claims that convey the identity of the >=20 > "Baseline PASSporT defines claims" ? First reference in a 4th-level = section??? >=20 >=20 >> origination and destination of personal communications. There are >=20 > 'personal'? so this can't be used by and between companies? Really,= there is nothing about any of this that pertains to the type of users or ev= en the content of the communication. >=20 > What is the exact definition or origination and destination? For exa= mple, there is an important distinction between the person making a call vs.= the device they are using, versus the provider they are going through. Whi= ch is meant here and how is the reader to know? (cf, call for a terminology = section.) >=20 >=20 >> two claims that are required for PASSporT, the "orig" and "dest" >> claims. Both "orig" and "dest" should have values that are JSON >> objects that include identities represented by key value pairs, wh= ere >=20 > 'key value pairs' aren't 'claims'? >=20 > should and not must? why? >=20 >=20 >> the key represents an identity type and the value is the identity >> string. Currently, these identities can be represented as either >=20 > So, there is expectation of other types? There needs to be a pointer= to an IANA registry. >=20 >=20 >> telephone numbers or Uniform Resource Indicators (URIs). The >> definition of how telephone numbers or URIs and examples are provi= ded >> below. >>=20 >> The "orig" JSON object MUST only have one key value pair represent= ing >> the asserted identity of any type (currently either "tn" or "uri")= of >> the originator of the personal communications signaling. >>=20 >> The "dest" JSON object MUST have at least have one key value pair, >> but could have multiple identity types (i.e. "tn" and/or "uri") bu= t >> only one of each. Additionaly, in the case of "dest" only, the >> identity type key value MUST be an array signaled by standard JSON >> brackets, even when there is a single identity value in the identi= ty >> type key value. >>=20 >> 3.2.2.1.1. "tn" - Telephone Number identity >=20 > A document that uses five-levels of section numbering warrants recons= ideration of its structure. >=20 >=20 >>=20 >> If the originating or destination identity is a telephone number, = the >> key representing the identity should be "tn". >=20 > should and not must??? why? >=20 >=20 >> Telephone Number strings for "tn" MUST be canonicalized according = to >> the procedures specified in [I-D.ietf-stir-rfc4474bis] Section 7.2= . >=20 > Actually, this dependency on 4474bis seems odd. >=20 > Given that the phone number construct is at the core of the work here= and this is the essential data object, and this object is presumably intend= ed for use outside of 4474bis, I'd expect that canonicalization algorithm to= be here. >=20 > If 4474 needs to cite/use the algorithm, it can cite here, which it a= lready will have to do. There is no other normative use of 4474 in this doc= ument. >=20 >=20 >=20 >> 3.2.2.1.2. "uri" - URI identity >>=20 >> If any of the originating or destination identities is of the form >> URI, as defined in [RFC3986], the key representing the identity >> should be "uri" URI form of the identity. >=20 > should and not must? why? >=20 >=20 >> 3.2.2.1.3. Future identity forms >>=20 >> We recognize that in the future there may be other standard >> mechanisms for representing identities. The "orig" and "dest" JSO= N >>=20 >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Pag= e 6] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> objects with "tn" and "uri" allow for other identity types with >> unique keys to represent these forms. >=20 > Recognition is dandy, but where is the specification detail to suppor= t the extensibility? >=20 >=20 >> 3.2.2.1.4. Examples >=20 > *** Explain these examples, so they aren't merely syntax detail *** >=20 >=20 >> Single Originator to Single Destination example: >>=20 >> { >> "dest":{"uri":["sip:alice@example.com"]}, >> "iat":"1443208345", >> "orig":{"tn":"12155551212"} >> } >>=20 >> Single Originator to Multiple Destination Identities example: >>=20 >> { >> "dest":{ >> "tn":["12125551212"], >> "uri":["sip:alice@example.com", >> "sip:bob@example.net"] >> }, >> "iat":"1443208345", >> "orig":{"tn":"12155551212"} >> } >>=20 >> 3.2.2.2. "mky" - Media Key claim >>=20 >> Some protocols that use PASSporT convey hashes for media security >> keys within their signaling in order to bind those keys to the >> identities established in the signaling layers. One example would= be >> the DTLS-SRTP key fingerprints carried in SDP via the "a=3Dfingerpri= nt" >> attribute; multiple instances of that fingerprint may appear in a >> single SDP body corresponding to difference media streams offered. >=20 > difference -> different? >=20 > The above text belongs elsewhere, explaining the overall set of capab= ilities, use cases, and the like In a definitions section like this, focus = on definitions, not discussions about use. >=20 > First use of 'SDP', with no explanation of its meaning. >=20 > 'DTLS-SRTP' citation? >=20 > And again, how does this citation slip into a transport-independent o= bject signing spec? >=20 >=20 >=20 >> The "mky" value of PASSporT contains a hexadecimal key presentatio= n >> of any hash(es) necessary to establish media security via DTLS-SRT= P. >> This mky value should be formated in a JSON form including the 'al= g' >> and 'dig' keys with the corresponding algorithm and hexadecimal >> values. Note that per guidance of Section 5 of this document any >> whitespace and line feeds must be removed. If there is multiple >=20 > forward pointer. Sometimes these are necessary, but in general they = impede reading comprehension. >=20 > Redundant specification. Saying here something that is also specifie= d elsewhere in the document invites divergence in reader understanding. Cite= , perhaps, but do /not/ summarize. >=20 > Is all of this summary? Anything new here? The reader can't tell. >=20 > "If there is multiple fingerprint values, more than one,"? huh? >=20 > Where do 'dig' and 'alg' come from? They are not explicitly introduc= ed, even with a citation. >=20 >=20 >> fingerprint values, more than one, the fingerprint values should b= e >=20 > should and not must? why? >=20 >=20 >> constructed as a JSON array denoted by bracket characters. For th= e >> 'dig' key value, the hash value should be the hexadecimal value >> without any colons, in order to provide a more efficient, compact >> form to be encoded in PASSporT token claim. >=20 > "in order to provide a more efficient, compact form" is marketing lan= guage. It invites debate while offering no useful technical substance. >=20 >=20 >> An example claim with "mky" claim is as follows: >>=20 >> For an SDP offer that includes the following fingerprint values, >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Pag= e 7] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> a=3Dfingerprint:sha-256 02:1A:CC:54:27:AB:EB:9C:53:3F:3E:4B:65: >> 2E:7D:46:3F:54:42:CD:54:F1:7A:03:A2:7D:F9:B0:7F:46:19:B2 >> a=3Dfingerprint:sha-256 4A:AD:B9:B1:3F:82:18:3B:54:02:12:DF:3E: >> 5D:49:6B:19:E5:7C:AB:3E:4B:65:2E:7D:46:3F:54:42:CD:54:F1 >>=20 >> the PASSporT Payload object would be: >>=20 >> { >> "dest":{"uri":["sip:alice@example.com"]}, >> "iat":"1443208345", >> "mky":[ >> { >> "alg":"sha-256", >> "dig":"021ACC5427ABEB9C533F3E4B652E7D463F5442CD54 >> F17A03A27DF9B07F4619B2" >> }, >> { >> "alg":"sha-256", >> "dig":"4AADB9B13F82183B540212DF3E5D496B19E57C >> AB3E4B652E7D463F5442CD54F1" >> } >> ], >> "orig":{"tn":"12155551212"} >> } >>=20 >> 3.3. PASSporT Signature >>=20 >> The signature of the PASSporT is created as specified by JWS using >> the private key corresponding to the X.509 public key certificate >> referenced by the "x5u" header parameter. >=20 > 'corresponding to' vs. 'included in'? >=20 >=20 >> 4. Extending PASSporT >>=20 >> PASSporT represents the bare minimum set of claims needed to asser= t >=20 > represents vs. is or has? >=20 > (FWIW, this isn't quibbling. It is an example of the difference betw= een regular prose writing and direct, specification language.) >=20 >=20 >> the originating identity and support the secure propoerties discus= sed >> in various parts of this document, however there will certainly be >> both new uses and ways of extending the application and usage of >> PASSPorT that requires the ability to extend the defined base set = of >> claims to represent other information requiring assertion or >> validation beyond the identity itself. >=20 > there's that 'certainly' again and this time it's predicting the futu= re. > tsk. don't do that. also, new and extended tends towards redundancy, = as > does the entire sentence's structure. I think the technical statement= is: >=20 > Passport can be extended to support additional claims. >=20 > If you want to get really flowery, you might 'as needed' at the end..= . >=20 >=20 >> 4.1. "ppt" (PASSporT) header parameter >>=20 >> For the extension of the base set of claims defined in this docume= nt, >=20 > For the -> For >=20 >=20 >> a new JWS header parameter "ppt" MUST be used with a string that >> uniquely identifies and points to a profile specification that >> defines any new claims that would extend the base set of claims of >> PASSporT. >=20 > extension =3D=3D profile ?? >=20 > What is a profile of Passport? Where is this defined? >=20 > ('jws header parameter'.) >=20 > What is the purpose of a profile and a profile label? How is it used= ? >=20 >=20 > 'identifies and points to'? what does points to mean? >=20 >=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Pag= e 8] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> An example header with an extended PASSporT profile of "foo" is as >=20 > profile of -> profile name >=20 >=20 >> follows: >>=20 >> { >> "alg":"ES256", >> "ppt":"foo", >> "typ":"passport", >> "x5u":"https://tel.example.org/passport.cer" >> } >>=20 >> 4.2. Extended PASSporT Claims >>=20 >> Future specifications that define such extensions to the PASSporT >=20 > [Future] remove >=20 > [such] remove. there's no context for it. >=20 >=20 >> mechanism MUST explicitly designate what claims they include beyon= d >=20 > designate -> specify (it's defining, not appointing) >=20 >=20 >> the base set of claims from this document, the order in which they >> will appear, and any further information necessary to implement th= e >> extension. All extensions MUST incorporate the baseline JWT eleme= nts >> specified in Section 3; claims may only be appended to the claims >=20 > If all extensions include the baseline, then 'must incorporate' is an= odd way to say that >=20 > This seems best and first handled by earlier in the spec, by providin= g a syntax (and text) that shows the base set and then an optional extended = set. With that setup, it is clear that extensions are always /in addition t= o/ the base. >=20 >=20 >> object specified; they can never be subtracted or re-ordered. >=20 > What does it mean to be subtracted? Perhaps 'removed'? Or are they s= ubject to arithmetic modification? >=20 >=20 >> Specifying new claims follows the baseline JWT procedures ([RFC751= 9] >> Section 10.1). Note that understanding an extension as a verifier= is >> always optional for compliance with this specification (though fut= ure >=20 > That's not a 'note'; that's a fundamental construct. It needs to be = stated much earlier and much more distinctly and as an explicitly normative = assertion. >=20 > Also, this seems to be the first reference to the verifier! >=20 > Also we need a description of the handling of a passport object in te= rms of creation and consumption.) >=20 >=20 >> specifications or profiles for deployment environments may make ot= her >> "ppt" values mandatory). The creator of a PASSporT object cannot >> assume that verifiers will understand any given extension. Verifi= ers >> that do support an extension may then trigger appropriate >> application-level behavior in the presence of an extension; author= s >> of extensions should provide appropriate extension-specific guidan= ce >> to application developers on this point. >>=20 >> 5. Deterministic JSON Serialization >>=20 >> In order to provide a deterministic representation of the PASSporT >> Header and Claims, particularly if PASSporT is used across multipl= e >> signaling environments, the JSON header object and JSON Claim obje= ct >> MUST be computed as follows. >=20 > The implication that there can be non-deterministic representations i= s > pretty odd and at least needs explanation, assuming the issue is real= . >=20 >=20 >> The JSON object MUST follow the rules for the construction of the >> thumbprint of a JSON Web Key (JWK) as defined in [RFC7638] Section= 3. >> Each JSON object MUST contain no whitespace or line breaks before = or >> after any syntactic elements and with the required members ordered >> lexicographically by the Unicode [UNICODE] code points of the memb= er >> names. >=20 > mumble. >=20 >=20 >> In addition, the JSON header and claim members MUST follow the >> lexicographical ordering and character and string rules defined in >> [RFC7638] Section 3.3. >>=20 >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Pag= e 9] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> 5.1. Example PASSport deterministic JSON form >>=20 >> For the example PASSporT Payload shown in Section 3.2.2.2, the >> following is the deterministic JSON object form. >>=20 >> {"dest":{"uri":["sip:alice@example.com"],"iat": 1443208345,"mk= y" >> :[{"alg":"sha-256","dig":"021ACC5427ABEB9C533F3E4B652E7D463F54= 42 >> CD54F17A03A27DF9B07F4619B2"},{"alg":"sha-256","dig":"4AADB9B13= F8 >> 2183B540212DF3E5D496B19E57CAB3E4B652E7D463F5442CD54F1"}], >> "orig":{"tn":"12155551212"}} >=20 > Perhaps explain the steps followed to produce this? Perhaps show the > intermediate forms? >=20 >=20 >=20 >> 6. Human Readability >>=20 >> JWT [RFC7519] and JWS [RFC7515] are defined to use Base64 and/or U= TF8 >> encoding to the Header, Payload, and Signature sections. However, >> many personal communications protocols, such as SIP and XMPP, use = a >> "human readable" format to allow for ease of use and ease of >=20 > And email and FTP and HTTP and... >=20 > Actually the use of the form has nothing to do with the purpose of th= e > application. As noted, it merely makes debugging and monitoring easie= r. >=20 >=20 >> operational debugging and monitoring. As such, specifications usi= ng >> PASSporT may provide guidance on whether Base64 encoding or plain >> text will be used for the construction of the PASSporT Header and >> Claim sections. >=20 > The section is mislabeled and probably out of scope. It's trying to s= ay > there there can be alternative encodings of this json object and that > this spec won't prohibit that happening by other specs. >=20 > In all likelihood, this section should be removed. It doesn't specify > anything. >=20 >=20 >> 7. Security Considerations >>=20 >> 7.1. Avoidance of replay and cut and paste attacks >>=20 >> There are a number of security considerations for use of the token >=20 > I suspect they are not 'security considerations' as much as 'mechanis= ms' or 'provisions' >=20 >=20 >> for avoidance of replay and cut and paste attacks. PASSporT token= s >> must be sent along with other application level protocol informati= on >=20 > Huh? You are trying to dictate application-level transport behavior? >=20 > This smacks of layer/scoping violation. >=20 >=20 >> (e.g. for SIP an INVITE as defined in [RFC3261]). There should be= a >> link between various information provided in the token and >> information provided by the application level protocol information= . >=20 > Why? >=20 >=20 >> These would include: >>=20 >> o "iat" claim should closely correspond to a date/time the messag= e >=20 > The semantics of iat are defined earlier. Either there is compliance = or > there isn't. The discussion here, therefore, should probably say > something like "a valid iat claim aids in detecting re-use at a later= time." >=20 >=20 >> was originated. It should also be within a relative delta time >=20 > What is a delta time? How is the reader to know? Where is it define= d? I suspect what is meant is that it's deviation from time of origination s= hould be small. If this has a more precise technical definition, then cite = it. >=20 >=20 >> that is reasonable for clock drift and transmission time >> characteristics associated with the application using the PASSp= orT >> token. > > >> o "dest" claim is included to prevent the ability to use a >> previously originated message to send to another destination pa= rty >=20 > the ability to -> using (or use of) >=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page= 10] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> 7.2. Solution Considerations >>=20 >> It should be recognized that the use of this token should not, in >> it's own right, be considered a full solution for absolute non- >> repudiation of the persona being asserted. This only provides non= - >> repudiation of the signer of PASSporT. If the signer and the pers= ona >=20 > huh? So the originator isn't really being validated, as claimed??? >=20 >=20 >> are not one in the same, which can and often will be the case in >> telecommunications networks today, protecting the destination part= y >> from being spoofed may take some interpretation or additional >> verification of the link between the PASSporT signature and the >> persona being asserted. >>=20 >> In addition, the telecommunications systems and specifications tha= t >> use PASSporT should in practice provide mechanisms for: >>=20 >> o Managing X.509 certificates and X.509 certificate chains to an >> authorized trust anchor that can be a trusted entity to all >> participants in the telecommunications network >=20 > Touching this sort of topic is, at the very best, redundant with > specifications devoted to X.509. Just cite them and don't attempt to > repeat them. >=20 >=20 >> o Accounting for entities that may route calls from other peer or >> interconnected telecommunications networks that are not part of >> the "trusted" communications network or may not be following th= e >> usage of PASSporT or the profile of PASSporT appropriate to tha= t >> network >=20 > Passport doesn't do calls. Dictating activity involving calls is out= of scope. >=20 > On the other hand, perhaps this qualifies for a discussion about tran= sferring passport objects across administrative (trust) domain boundaries? >=20 > At best, this section seems to be trying to compensate for the lack o= f a framework discussion about the problem domain and the practical uses of = the various specifications being produced. >=20 >=20 >> o Following best practices around management and security of X.50= 9 >> certificates >=20 > cf, above, about redundancies. Perhaps this is the bullet that should > remain, while deleting the other one? >=20 >=20 >> 7.3. Privacy Considerations >>=20 >> Because PASSporT explicity includes claims of identitifiers of >=20 > explicity -> explicitly >=20 > identitifiers -> identifiers >=20 >=20 >> parties involved in communications, times, and potentially other c= all >> detail, care should be taken outside of traditional protected or >> private telephony communications paths where there may be concerns >> about exposing information to either unintended or illegitimately >> intented actors. These identifiers are often exposed through many >> communications signaling protocols as of today, but appropriate >> precautions should be taken. >=20 > intented -> intended >=20 >=20 > awk. >=20 > Illegitimately intended? What does that mean? >=20 > More fundamentally it isn't clear to me what this is really saying. >=20 >=20 >> 8. IANA Considerations >=20 > This section just sits here, uncited anywhere else in the document? E= ach item specified should be referenced in the body of the main specificatio= n, with a pointer into this section. >=20 >=20 >> 8.1. Media Type Registration >>=20 >> 8.1.1. Media Type Registry Contents Additions Requested >>=20 >> This section registers the "application/passport" media type >> [RFC2046] in the "Media Types" registry in the manner described in >>=20 >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page= 11] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> [RFC6838], which can be used to indicate that the content is a >> PASSporT defined JWT and JWS. >>=20 >> o Type name: application >>=20 >> o Subtype name: passport >>=20 >> o Required parameters: n/a >>=20 >> o Optional parameters: n/a >>=20 >> o Encoding considerations: 8bit; application/passport values outs= ide >> the US-ASCII range are encoded using percent encoding as descri= bed >> in section 2.1 of RFC 3986 (some values may be the empty string= ), >> each separated from the next by a single period ('.') character= . >>=20 >> o Security considerations: See the Security Considerations sectio= n >> of RFC 7515. >>=20 >> o Interoperability considerations: n/a >>=20 >> o Published specification: draft-ietf-stir-passport-05 >>=20 >> o Applications that use this media type: STIR and other applicati= ons >> that require identity related assertion >>=20 >> o Fragment identifier considerations: n/a >>=20 >> o Additional information: >>=20 >> * Magic number(s): n/a >>=20 >> * File extension(s): n/a >>=20 >> * Macintosh file type code(s): n/a >>=20 >> o Person and email address to contact for further information: Ch= ris >> Wendt, chris-ietf@chriswendt.net >>=20 >> o Intended usage: COMMON >>=20 >> o Restrictions on usage: none >>=20 >> o Author: Chris Wendt, chris-ietf@chriswendt.net >>=20 >> o Change Controller: IESG >>=20 >> o Provisional registration? No >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page= 12] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> 8.2. JSON Web Token Claims Registration >>=20 >> 8.2.1. Registry Contents Additions Requested >>=20 >> o Claim Name: "orig" >>=20 >> o Claim Description: Originating Identity String >>=20 >> o Change Controller: IESG >>=20 >> o Specification Document(s): Section 3.2 of draft-ietf-stir- >> passport-05 >>=20 >> o Claim Name: "dest" >>=20 >> o Claim Description: Destination Identity String >>=20 >> o Change Controller: IESG >>=20 >> o Specification Document(s): Section 3.2 of draft-ietf-stir- >> passport-05 >>=20 >> o Claim Name: "mky" >>=20 >> o Claim Description: Media Key Fingerprint String >>=20 >> o Change Controller: IESG >>=20 >> o Specification Document(s): Section 3.2 of draft-ietf-stir- >> passport-05 >>=20 >> 9. Acknowledgements >>=20 >> Particular thanks to members of the ATIS and SIP Forum NNI Task Gr= oup >> including Jim McEchern, Martin Dolly, Richard Shockey, John Barnhi= ll, >> Christer Holmberg, Victor Pascual Avila, Mary Barnes, Eric Burger = for >> their review, ideas, and contributions also thanks to Henning >> Schulzrinne, Russ Housley, Alan Johnston, Richard Barnes, Mark >> Miller, and Ted Hardie for valuable feedback on the technical and >> security aspects of the document. Additional thanks to Harsha Bel= lur >> for assistance in coding the example tokens. >>=20 >> 10. References >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page= 13] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> 10.1. Normative References >>=20 >> [I-D.ietf-stir-rfc4474bis] >> Peterson, J., Jennings, C., Rescorla, E., and C. Wendt, >> "Authenticated Identity Management in the Session >> Initiation Protocol (SIP)", draft-ietf-stir-rfc4474bis-= 10 >> (work in progress), July 2016. >>=20 >> [RFC2046] Freed, N. and N. Borenstein, "Multipurpose Internet Mai= l >> Extensions (MIME) Part Two: Media Types", RFC 2046, >> DOI 10.17487/RFC2046, November 1996, >> . >>=20 >> [RFC3986] Berners-Lee, T., Fielding, R., and L. Masinter, "Unifor= m >> Resource Identifier (URI): Generic Syntax", STD 66, >> RFC 3986, DOI 10.17487/RFC3986, January 2005, >> . >>=20 >> [RFC6838] Freed, N., Klensin, J., and T. Hansen, "Media Type >> Specifications and Registration Procedures", BCP 13, >> RFC 6838, DOI 10.17487/RFC6838, January 2013, >> . >>=20 >> [RFC7515] Jones, M., Bradley, J., and N. Sakimura, "JSON Web >> Signature (JWS)", RFC 7515, DOI 10.17487/RFC7515, May >> 2015, . >>=20 >> [RFC7518] Jones, M., "JSON Web Algorithms (JWA)", RFC 7518, >> DOI 10.17487/RFC7518, May 2015, >> . >>=20 >> [RFC7519] Jones, M., Bradley, J., and N. Sakimura, "JSON Web Toke= n >> (JWT)", RFC 7519, DOI 10.17487/RFC7519, May 2015, >> . >>=20 >> [RFC7638] Jones, M. and N. Sakimura, "JSON Web Key (JWK) >> Thumbprint", RFC 7638, DOI 10.17487/RFC7638, September >> 2015, . >>=20 >> [UNICODE] "The Unicode Consortium, "The Unicode Standard"", >> . >>=20 >> 10.2. Informative References >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page= 14] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> [RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston= , >> A., Peterson, J., Sparks, R., Handley, M., and E. >> Schooler, "SIP: Session Initiation Protocol", RFC 3261, >> DOI 10.17487/RFC3261, June 2002, >> . >>=20 >> [RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S., >> Housley, R., and W. Polk, "Internet X.509 Public Key >> Infrastructure Certificate and Certificate Revocation L= ist >> (CRL) Profile", RFC 5280, DOI 10.17487/RFC5280, May 200= 8, >> . >>=20 >> [RFC7340] Peterson, J., Schulzrinne, H., and H. Tschofenig, "Secu= re >> Telephone Identity Problem Statement and Requirements", >> RFC 7340, DOI 10.17487/RFC7340, September 2014, >> . >>=20 >> Appendix A. Example PASSporT JWS Serialization and Signature >>=20 >> For PASSporT, there will always be a JWS with the following member= s: >>=20 >> o "protected", with the value BASE64URL(UTF8(JWS Protected Header= )) >>=20 >> o "payload", with the value BASE64URL (JWS Payload) >>=20 >> o "signature", with the value BASE64URL(JWS Signature) >>=20 >> Note: there will never be a JWS Unprotected Header for PASSporT. >>=20 >> First, an example PASSporT Protected Header is as follows: >>=20 >> { >> "typ":"passport", >> "alg":"ES256", >> "x5u":"https://cert.example.org/passport.cer" >> } >>=20 >> This would be serialized to the form: >>=20 >> {"alg":"ES256","typ":"passport","x5u":"https://cert.example.or= g/ >> passport.cer"} >>=20 >> Encoding this with UTF8 and BASE64 encoding produces this value: >>=20 >> eyJhbGciOiJFUzI1NiIsInR5cCI6InBhc3Nwb3J0IiwieDV1IjoiaHR0cHM6Ly= 9j >> ZXJ0LmV4YW1wbGUub3JnL3Bhc3Nwb3J0LmNlciJ9 >>=20 >> Second, an example PASSporT Payload is as follows: >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page= 15] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> { >> "dest":{"uri":["sip:alice@example.com"]} >> "iat":"1443208345", >> "orig":{"tn":"12155551212"} >> } >>=20 >> This would be serialized to the form: >>=20 >> {"dest":{"uri":["sip:alice@example.com"]},"iat":"1443208345", >> "orig":{"tn":"12155551212"}} >>=20 >> Encoding this with the UTF8 and BASE64 encoding produces this valu= e: >>=20 >> eyJkZXN0Ijp7InVyaSI6WyJzaXA6YWxpY2VAZXhhbXBsZS5jb20iXX0sImlhd >> CI6IjE0NDMyMDgzNDUiLCJvcmlnIjp7InRuIjoiMTIxNTU1NTEyMTIifX0 >>=20 >> Computing the digital signature of the PASSporT Signing Input >> ASCII(BASE64URL(UTF8(JWS Protected Header)) || '.' || BASE64URL(JW= S >> Payload)) >>=20 >> rq3pjT1hoRwakEGjHCnWSwUnshd0-zJ6F1VOgFWSjHBr8Qjpjlk-cpFYpFYso >> jNCpTzO3QfPOlckGaS6hEck7w >>=20 >> The final PASSporT token is produced by concatenating the values i= n >> the order Header.Payload.Signature with period (',') characters. = For >> the above example values this would produce the following: >>=20 >> eyJhbGciOiJFUzI1NiIsInR5cCI6InBhc3Nwb3J0IiwieDV1IjoiaHR0cHM6Ly >> 9jZXJ0LmV4YW1wbGUub3JnL3Bhc3Nwb3J0LmNlciJ9 >> . >> eyJkZXN0Ijp7InVyaSI6WyJzaXA6YWxpY2VAZXhhbXBsZS5jb20iXX0sImlhd >> CI6IjE0NDMyMDgzNDUiLCJvcmlnIjp7InRuIjoiMTIxNTU1NTEyMTIifX0 >> . >> rq3pjT1hoRwakEGjHCnWSwUnshd0-zJ6F1VOgFWSjHBr8Qjpjlk-cpFYpFYso >> jNCpTzO3QfPOlckGaS6hEck7w >>=20 >> A.1. X.509 Private Key Certificate for Example >>=20 >> -----BEGIN EC PRIVATE KEY----- >> MHcCAQEEIFeZ1R208QCvcu5GuYyMfG4W7sH4m99/7eHSDLpdYllFoAoGCCqGSM= 49 >> AwEHoUQDQgAE8HNbQd/TmvCKwPKHkMF9fScavGeH78YTU8qLS8I5HLHSSmlATL= cs >> lQMhNC/OhlWBYC626nIlo7XeebYS7Sb37g=3D=3D >> -----END EC PRIVATE KEY----- >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page= 16] >>=20 >> Internet-Draft PASSporT July = 2016 >>=20 >>=20 >> A.2. X.509 Public Key Certificate for Example >>=20 >> -----BEGIN PUBLIC KEY----- >> MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE8HNbQd/TmvCKwPKHkMF9fScavG= eH >> 78YTU8qLS8I5HLHSSmlATLcslQMhNC/OhlWBYC626nIlo7XeebYS7Sb37g=3D=3D >> -----END PUBLIC KEY----- >>=20 >> Authors' Addresses >>=20 >> Chris Wendt >> Comcast >> One Comcast Center >> Philadelphia, PA 19103 >> USA >>=20 >> Email: chris-ietf@chriswendt.net >>=20 >>=20 >> Jon Peterson >> Neustar Inc. >> 1800 Sutter St Suite 570 >> Concord, CA 94520 >> US >>=20 >> Email: jon.peterson@neustar.biz >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >> Wendt & Peterson Expires January 23, 2017 [Page= 17] >=20 > -- >=20 > Dave Crocker > Brandenburg InternetWorking > bbiw.net >=20 > -- >=20 > Dave Crocker > Brandenburg InternetWorking > bbiw.net >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir =20 _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir =20 From nobody Fri Jul 29 09:24:48 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CA19112B00B for ; Fri, 29 Jul 2016 09:24:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.107 X-Spam-Level: X-Spam-Status: No, score=-1.107 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RDNS_NONE=0.793] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MIHfb5srj5bm for ; Fri, 29 Jul 2016 09:24:45 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 95EA712D7F1 for ; Fri, 29 Jul 2016 09:24:45 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u6TGPTTZ018215 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Fri, 29 Jul 2016 09:25:29 -0700 To: Richard Shockey , Eric Burger References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <4C7B58CB-3859-4ED3-97BF-F9E3EF880523@shockey.us> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <034f0754-7c81-3ceb-5627-7f7af76efe29@dcrocker.net> Date: Fri, 29 Jul 2016 09:24:38 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <4C7B58CB-3859-4ED3-97BF-F9E3EF880523@shockey.us> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Cc: "stir@ietf.org" Subject: Re: [stir] Review of: draft-ietf-stir-passport-05 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Jul 2016 16:24:47 -0000 Richard, et al, On 7/29/2016 8:17 AM, Richard Shockey wrote: > In general, I agree with Eric’s general characterization of the > current status of STIR etc. As to the points Eric makes first yes > there are use cases for STIR passport that frankly some of us do not > want to go into extensive detail on. Some of those are ones directly > related to public safety issues and the validated identity of the > calling party. I do NOT believe we need text on those issues. Silence > is often golden. This being a technical forum, the point I made was about the risk of design generalities that are made without demonstrated utility. An argument that says "behind this curtain there are the needed demonstrations, but the unwashed won't be allowed to see them" precludes meaningful technical analysis in this public forum, where the approval is supposed to be made for the design. If specifications need to be kept private, that's fine. Keep them private. And keep all the work private. But that's not the IETF, of course. Otherwise, please don't invoke a 'trust us' placeholder where substantive, public technical analysis is required. > On the second point Eric is entirely correct that the issues of > certificate/key management are strictly in the domain of > national/industry policy re E.164 and as such have no business in the > IETF whatsoever. We will deal with those issues in other bodies as > deemed appropriate. So I do understand the operational point, concerning nationally- and internationally-regulated telecom services. And again, that's fine. But I did not see anything in the specification that said that this work is restricted to that use. Nor would I expect to, given that SIP and other possible applications of Passport might operate in the same sort of unregulated and even p2p modes as most other Internet services. Given that key management has such a long and frustrating history, leaving it as an open issue to be decided elsewhere mostly renders the current work useless. > Along with Eric, silence on the existing set of documents in LC is, > for now, acceptance. Except that's not how the IETF is supposed to work, especially for a relatively new and unstable specification. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Fri Jul 29 10:12:37 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 09A7212DB11 for ; Fri, 29 Jul 2016 10:12:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.601 X-Spam-Level: X-Spam-Status: No, score=-102.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yltMaJ29c96S for ; Fri, 29 Jul 2016 10:12:32 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0a-0018ba01.pphosted.com [67.231.149.94]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 539EE12DB0F for ; Fri, 29 Jul 2016 10:12:32 -0700 (PDT) Received: from pps.filterd (m0078666.ppops.net [127.0.0.1]) by mx0a-0018ba01.pphosted.com (8.16.0.17/8.16.0.17) with SMTP id u6TH5jmV009284; Fri, 29 Jul 2016 13:12:30 -0400 Received: from stntexhc11.cis.neustar.com ([156.154.17.216]) by mx0a-0018ba01.pphosted.com with ESMTP id 24c4pqng47-1 (version=TLSv1 cipher=AES128-SHA bits=128 verify=NOT); Fri, 29 Jul 2016 13:12:30 -0400 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.94]) by stntexhc11.cis.neustar.com ([::1]) with mapi id 14.03.0279.002; Fri, 29 Jul 2016 13:12:28 -0400 From: "Peterson, Jon" To: "dcrocker@bbiw.net" , IETF STIR Mail List Thread-Topic: [stir] Review of: draft-ietf-stir-passport-05 Thread-Index: AQHR6Pa+qcjKJ8B9hE+IbOWpflw+YqAwC2aA Date: Fri, 29 Jul 2016 17:12:27 +0000 Message-ID: References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> In-Reply-To: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.6.3.160329 x-originating-ip: [10.96.13.16] Content-Type: text/plain; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-07-29_12:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1607290171 Archived-At: Subject: Re: [stir] Review of: draft-ietf-stir-passport-05 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Jul 2016 17:12:36 -0000 Review is good, and certainly I'd agree that the document hasn't gotten this kind of deep reading prior to WGLC. So it's appreciated. As you might gather from the other responses circulating, there is some urgency about progressing - while it's true that work in STIR took some time to get in gear, there has been intensifying regulatory and industry interest since last summer that has led to the rise in recent energy that you observed. I don't want to be in the business of shipping wine before its time - but also, because of that external urgency, I'm reluctant to delay this for the sake of bolstering purely informational text. That much said, some bolstering can no doubt be done without meaningful delay, and I think some of your suggestions here do make a lot of sense. A couple notes on your substantive points below. >Although the text provides details of 'how' to compose a passport token, >it never actually says what passport is. There are some later comments >that imply what it is, or seem to assume a knowledge of what it is, but >it's never defined as a technical construct. By way of example, how does >it differ from the function of an X.509 cert? At a high level, PASSporT is a token signed by a cert, not a cert itself. I think if we made the relationship to JWT clearer from the very start of the draft, that might not be so easy to misunderstand. I'd say the same about the relationship of this document to the STIR problem statement, threat model, and the certs document in particular. We have divided up the work here into modular chunks, and I don't want to introduce redundancy or desynchronization, but we should at least have clear pointers up front to where you go to understand both the bigger picture and the details of related modular components. >As to the choice of JWT, it seems odd, since it isn't natural to the SIP >context, which is essential for the chartered work, and therefore >requires an additional layer of translation for use with SIP. We had a major intervention in the work last fall to the effect that we need to build more generically for real-time communications rather than just SIP. We're interested in getting this to work properly with WebRTC, with Jingle, and similar environments - hopefully in a way that will gateway to SIP cleanly. I agree that JWT might not have been the obvious choice, but as a generic signed container for claims and metadata, I mean, it'll do the job. In terms of how we got here historically, I might add that previously SIP just signed a concatenated string made up[ of claims and metadata - the difference between signing that and signing the same information with a JSON wrapper turned out to be slight. PASSporT is less generic than JWT itself, so what we're defining here is not some new and generic capability for asserting identity information, but is instead an application of that existing work. >In terms of pragmatics, here are two operational questions that I can't >answer, based on this specification, and yet they are fundamental to the >utility of this work. > > How is key rollover done? > > How is delegation done, such as for use by authorized third > parties? Those are both questions about the certificates that sign PASSporT, rather than the PASSporT token itself, I think. Again, perhaps another symptom that we need more pointers up front to the stir-certs document. Chris and I will go through the more specific points below along with the rest of Last Call comments - like I said, I think there are a lot of places here where you are quite right some clarification or bolstering informational text is required. Jon Peterson Neustar, Inc. > > > >Detailed Comments >----------------- > > >> STIR C. Wendt >> Internet-Draft Comcast >> Intended status: Standards Track J. Peterson >> Expires: January 23, 2017 Neustar Inc. >> July 22, 2016 >> >> >> Persona Assertion Token >> draft-ietf-stir-passport-05 >> >> Abstract >> >> This document defines a token format for verifying with non- > > [format] remove or remove [token] > >Is the timestamp the basis of claiming non-repudiation? > > >> repudiation the sender of and authorization to send information >> related to the originator of personal communications. A > >'info related to'... what does this mean? > > >> cryptographic signature is defined to protect the integrity of the >> information used to identify the originator of a personal >> communications session (e.g. the telephone number or URI) and verify >> the accuracy of this information at the destination. The > >'accuracy'? validates authorship, not validity, I suspect. > >A signature's primary purpose usually is authenticate origination, >authorship, or the like, where integrity is a side-effect of the >methodology. Integrity as the primary function would typically occur >only when the identity of the signer need be no more than something like >'whomever I interacted with previously'. I suspect that such a >session-limited identity semantic is not, in fact, the intent here. > > >> cryptographic signature is defined with the intention that it can >> confidently verify the originating persona even when the signature is >> sent to the destination party over an unsecure channel. The Persona > > unsecure -> insecure (unless the intend is reference to a loan?) > > >> Assertion Token (PASSporT) is particularly useful for many personal >> communications applications over IP networks and other multi-hop >> interconnection scenarios where the originating and destination >> parties may not have a direct trusted relationship. >> >> Status of This Memo >> >> This Internet-Draft is submitted in full conformance with the >> provisions of BCP 78 and BCP 79. >> >> Internet-Drafts are working documents of the Internet Engineering >> Task Force (IETF). Note that other groups may also distribute >> working documents as Internet-Drafts. The list of current Internet- >> Drafts is at http://datatracker.ietf.org/drafts/current/. >> >> Internet-Drafts are draft documents valid for a maximum of six months >> and may be updated, replaced, or obsoleted by other documents at any >> time. It is inappropriate to use Internet-Drafts as reference >> material or to cite them other than as "work in progress." >> >> This Internet-Draft will expire on January 23, 2017. >> >> >> >> >> >> >> >> >> Wendt & Peterson Expires January 23, 2017 [Page 1] >> ? >> Internet-Draft PASSporT July 2016 >> >> >> Copyright Notice >> >> Copyright (c) 2016 IETF Trust and the persons identified as the >> document authors. All rights reserved. >> >> This document is subject to BCP 78 and the IETF Trust's Legal >> Provisions Relating to IETF Documents >> (http://trustee.ietf.org/license-info) in effect on the date of >> publication of this document. Please review these documents >> carefully, as they describe your rights and restrictions with respect >> to this document. Code Components extracted from this document must >> include Simplified BSD License text as described in Section 4.e of >> the Trust Legal Provisions and are provided without warranty as >> described in the Simplified BSD License. >> >> Table of Contents >> >> 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 >> 2. Token Overview . . . . . . . . . . . . . . . . . . . . . . . 4 >> 3. PASSporT Definition . . . . . . . . . . . . . . . . . . . . . 4 >> 3.1. PASSporT Header . . . . . . . . . . . . . . . . . . . . . 4 >> 3.1.1. "typ" (Type) Header Parameter . . . . . . . . . . . . 4 >> 3.1.2. "alg" (Algorithm) Header Parameter . . . . . . . . . 5 >> 3.1.3. "x5u" (X.509 URL) Header Parameter . . . . . . . . . 5 >> 3.2. PASSporT Payload . . . . . . . . . . . . . . . . . . . . 5 >> 3.2.1. JWT defined claims . . . . . . . . . . . . . . . . . 5 >> 3.2.1.1. "iat" - Issued at claim . . . . . . . . . . . . . 5 >> 3.2.2. PASSporT specific claims . . . . . . . . . . . . . . 6 >> 3.2.2.1. Originating and Destination Identity Claims . . . 6 >> 3.2.2.2. "mky" - Media Key claim . . . . . . . . . . . . . 7 >> 3.3. PASSporT Signature . . . . . . . . . . . . . . . . . . . 8 >> 4. Extending PASSporT . . . . . . . . . . . . . . . . . . . . . 8 >> 4.1. "ppt" (PASSporT) header parameter . . . . . . . . . . . . 8 >> 4.2. Extended PASSporT Claims . . . . . . . . . . . . . . . . 9 >> 5. Deterministic JSON Serialization . . . . . . . . . . . . . . 9 >> 5.1. Example PASSport deterministic JSON form . . . . . . . . 10 >> 6. Human Readability . . . . . . . . . . . . . . . . . . . . . . 10 >> 7. Security Considerations . . . . . . . . . . . . . . . . . . . 10 >> 7.1. Avoidance of replay and cut and paste attacks . . . . . . 10 >> 7.2. Solution Considerations . . . . . . . . . . . . . . . . . 11 >> 7.3. Privacy Considerations . . . . . . . . . . . . . . . . . 11 >> 8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 11 >> 8.1. Media Type Registration . . . . . . . . . . . . . . . . . 11 >> 8.1.1. Media Type Registry Contents Additions Requested . . 11 >> 8.2. JSON Web Token Claims Registration . . . . . . . . . . . 13 >> 8.2.1. Registry Contents Additions Requested . . . . . . . . 13 >> 9. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 13 >> 10. References . . . . . . . . . . . . . . . . . . . . . . . . . 13 >> >> >> >> Wendt & Peterson Expires January 23, 2017 [Page 2] >> ? >> Internet-Draft PASSporT July 2016 >> >> >> 10.1. Normative References . . . . . . . . . . . . . . . . . . 14 >> 10.2. Informative References . . . . . . . . . . . . . . . . . 14 >> Appendix A. Example PASSporT JWS Serialization and Signature . . 15 >> A.1. X.509 Private Key Certificate for Example . . . . . . . . 16 >> A.2. X.509 Public Key Certificate for Example . . . . . . . . 17 >> Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 17 >> >> 1. Introduction >> >> In today's IP-enabled telecommunications world, there is a growing >> concern about the ability to trust incoming invitations for >> communications sessions, including video, voice and messaging. >> [RFC7340] As an example, modern telephone networks provide the >> ability to spoof the calling party telephone number for many >> legitimate purposes including providing network features and services >> on the behalf of a legitimate telephone number. However, as we have >> seen, bad actors have taken advantage of this ability for >> illegitimate and fraudulent purposes meant to trick telephone users >> to believe they are someone they are not. This problem can be >> extended to many emerging forms of personal communications. >> >> This document defines a common method for creating and validating a > >[common] delete > > >> token that cryptographically verifies an originating identity, or >> more generally a URI or application specific identity string > >'identity string'? what does this mean? > >'app string id'? what does this mean? > > >> representing the originator of personal communications. Through >> extended profiles other information relevant to the personal >> communications can also be attached to the token. The primary goal >> of PASSporT is to provide a common framework for signing persona > >What is a 'persona'? Where is this construct introduced or cited and >explained? > >'profiles'? Where is this construct introduced or cited and explained? > > >> related information in an extensible way. A secondary goal is to > >It seems to also be primary. > >(PPT provides a framework for signing related information) ? > > >> provide this functionality independent of any specific personal >> communications signaling call logic, so that creation and >> verification of persona information can be implemented in a flexible >> way and can be used in many personal communications applications >> including end-to-end applications that require different signaling >> protocols. It is anticipated that signaling protocol specific >> guidance will be provided in other related documents and >> specifications to specify how to use and transport PASSporT tokens, > >specs to spec... awkward phrasing > >as always, a specification that declares what is 'anticipated' moves >into purely hypothetical, which too-often proves to be wishful fantasy. >The reference doesn't specify anything and it creates a dependency that >well might not be satisfied. > >'tokens'? Where is this constructed introduced, cited or explained? Use >of a term like this implies that there is some distinctive meaning, but >really there isn't. This is a format specification. That's all. > >If there is a claim that the term token does have significance here, >then please explain it. For example, how is this token to be used? > >If the term is used merely as an inheritance from JWT, then cite that >early, to justify the term. > > >> however this is intentionally out of scope for this document. >> >> Note: As of the authoring of this document, >> [I-D.ietf-stir-rfc4474bis] provides details of how to use PASSporT >> within SIP signaling for the signing and verification of telephone >> numbers. > >remove Note. Or make it a note to RFC Editor to remove it, or rephrase >so it's useful 10 years from now. > > >> >> >> >> >> >> >> >> >> Wendt & Peterson Expires January 23, 2017 [Page 3] >> ? >> Internet-Draft PASSporT July 2016 >> >> >> 2. Token Overview >> >> Tokens are a convenient way of encapsulating information with > >Why? What are the alternatives? Why is this the starting point? > > >> associated digital signatures. They are used in many applications > >Such as? > >Anyhow, this section seems to take the construct of 'token' as being an >established term of art. It isn't. Or, at least, I've no idea what is >meant here that distinguishes a token from anything else, such as other >forms of encapsulation. Say/cite what a token is, if it is such a >distinctive thing. Say/cite how it differs from alternatives, if its >superiority is going to be touted. > > >> that require authentication, authorization, encryption, non- >> repudiation and other use cases. JSON Web Token (JWT) [RFC7519] and >> JSON Web Signature (JWS) [RFC7515] are designed to provide a compact >> form for many of these purposes and define a specific method and >> syntax for signing a specific set of information or "claims" within >> the token and therefore providing an extensible set of claims. >> Additionally, JWS provides extensible mechanisms for specifying the >> method and cryptographic algorithms used for the associated digital >> signatures. > >Note that there is nothing in the above text that actually explains what >a token is or how it differs from things that aren't tokens. > > >> 3. PASSporT Definition > >This section is not a definition. It's more like structure, or format, >or foundation or encoding. > > >> The PASSporT is constructed based on JWT [RFC7519] and JWS [RFC7515] >> specifications. JWS defines the use of JSON data structures in a >> specified canonical format for signing data corresponding to JOSE >> header, JWS Payload, and JWS Signature. JWT defines specific set of > > specific set -> a set > > >> claims that are represented by specified key value pairs which can be >> extended with custom keys for specific applications. >> >> 3.1. PASSporT Header >> >> The JWS token header is a JOSE header [RFC7515] that defines the type >> and encryption algorithm used in the token. > >The section starts with structure detail and ends with purpose. This >should be swapped. > > >> An example of the header for the case of an ECDSA P-256 digital >> signature would be the following, > >How is reader to know what that long string means? Is the doc only for >the cognoscenti? if so, which cognoscenti? > > >> { >> "typ":"passport", >> "alg":"ES256", >> "x5u":"https://cert.example.org/passport.cer" >> } > > *** EXPLAIN EXAMPLES, PLEASE *** > > >> 3.1.1. "typ" (Type) Header Parameter >> >> JWS defines the "typ" (Type) Header Parameter to declare the media >> type of the JWS. > >media type? IANA citation needed. (It was in an earlier version of the >draft!) > > >> For PASSporT Token the "typ" header MUST minimally include and begin >> with "passport". This represents that the encoded token is a JWT of >> type passport. > >Is it possible to begin with it and not include it? That is, 'include' >is redundant. 'minimally' is also not information, but it raises the >question: The other two attributes aren't required??? > >Also, this subsection is part of an Overview. Why does it have >normative content? Or is this not really an overview? > > >> >> Wendt & Peterson Expires January 23, 2017 [Page 4] >> ? >> Internet-Draft PASSporT July 2016 >> >> >> 3.1.2. "alg" (Algorithm) Header Parameter >> >> For PASSporT, the "alg" should be defined as follows, for the >> creation and verification of PASSporT tokens and their digital >> signatures ES256 MUST be implemented. >> >> Note that JWA [RFC7518] defines other algorithms that may be utilized >> or updated in the future depending on cryptographic strength >> requirements guided by current security best practice. >> >> 3.1.3. "x5u" (X.509 URL) Header Parameter >> >> As defined in JWS, the "x5u" header parameter is used to provide a >> URI [RFC3986] referring to the resource for the X.509 public key >> certificate or certificate chain [RFC5280] corresponding to the key > >So this service uses a classic X.509 authentication hierarchy? That's a >key design point, only mentioned in a third-level section. > > >> used to digitally sign the JWS. Note: The definition of what the URI >> represents in terms of the actor serving the X.509 public key is out > >'actor serving the X.509 public key' ? what does that mean? > > >> of scope of this document. However, generally this would correspond >> to an HTTPS or DNSSEC resource with the guidance that it MUST be a > > [a] remove > > >> TLS protected, per JWS spec. > >This /object/ specification (that is transport independent) dictates >/transport/ security??? This is probably wrong, but at least needs >careful explanation. > > >> >> 3.2. PASSporT Payload >> >> The token payload claims should consist of the information which > >[payload] remove; at best it's redundant > >'should'? not MUST? why? > >> needs to be verified at the destination party. This claim should >> correspond to a JWT claim [RFC7519] and be encoded as defined by the >> JWS Payload [RFC7515] > >should? why > >correspond??? what does that mean, in technical terms? > > >> The PASSporT defines the use of a number of standard JWT defined > >"The PASSporT" is an affectation. Both the 'the' and the use of case. > > >> headers as well as two new custom headers corresponding to the two > >header/s/? > >corresponding? referring? describing? identifying? addressing? > > >> parties associated with personal communications, the originator and >> terminator. These headers or key value pairs are detailed below. > > These headers or key value pairs are -> This information is > > >> Key values outside the US-ASCII range should be encoded using percent >> encoding as described in section 2.1 of RFC 3986, case normalized as >> described in 6.2.2.1 of [RFC3986]. Matching of these values should >> use string exact match. >> >> 3.2.1. JWT defined claims > >When something like this is imported from another spec, there needs to >be a precise pointer to the specific part of the spec defining it. > > >> 3.2.1.1. "iat" - Issued at claim >> >> The JSON claim MUST include the "iat" [RFC7519] defined claim issued >> at. As defined this should be set to a date cooresponding to the > > issued at -> "Issued At". > >It would be better to explicitly cite section 4.1.6 in that RFC. Readers >should not have to search an entire document to find the detail being >referenced. > >Also, note the MUST here. I suspect this conflicts with the normative >language above in the 'overview'. > > >> origination of the personal communications. The time value should be >> of the format defined in [RFC7519] Section 2 NumericDate. This is >> included for securing the token against replay and cut and paste >> >> >> >> >> Wendt & Peterson Expires January 23, 2017 [Page 5] >> ? >> Internet-Draft PASSporT July 2016 >> >> >> attacks, as explained further in the security considerations in >> section 7. >> >> 3.2.2. PASSporT specific claims >> >> 3.2.2.1. Originating and Destination Identity Claims >> >> Baseline PASSporT defines claims that convey the identity of the > >"Baseline PASSporT defines claims" ? First reference in a 4th-level >section??? > > >> origination and destination of personal communications. There are > >'personal'? so this can't be used by and between companies? Really, >there is nothing about any of this that pertains to the type of users or >even the content of the communication. > >What is the exact definition or origination and destination? For >example, there is an important distinction between the person making a >call vs. the device they are using, versus the provider they are going >through. Which is meant here and how is the reader to know? (cf, call >for a terminology section.) > > >> two claims that are required for PASSporT, the "orig" and "dest" >> claims. Both "orig" and "dest" should have values that are JSON >> objects that include identities represented by key value pairs, where > >'key value pairs' aren't 'claims'? > >should and not must? why? > > >> the key represents an identity type and the value is the identity >> string. Currently, these identities can be represented as either > >So, there is expectation of other types? There needs to be a pointer to >an IANA registry. > > >> telephone numbers or Uniform Resource Indicators (URIs). The >> definition of how telephone numbers or URIs and examples are provided >> below. >> >> The "orig" JSON object MUST only have one key value pair representing >> the asserted identity of any type (currently either "tn" or "uri") of >> the originator of the personal communications signaling. >> >> The "dest" JSON object MUST have at least have one key value pair, >> but could have multiple identity types (i.e. "tn" and/or "uri") but >> only one of each. Additionaly, in the case of "dest" only, the >> identity type key value MUST be an array signaled by standard JSON >> brackets, even when there is a single identity value in the identity >> type key value. >> >> 3.2.2.1.1. "tn" - Telephone Number identity > >A document that uses five-levels of section numbering warrants >reconsideration of its structure. > > >> >> If the originating or destination identity is a telephone number, the >> key representing the identity should be "tn". > >should and not must??? why? > > >> Telephone Number strings for "tn" MUST be canonicalized according to >> the procedures specified in [I-D.ietf-stir-rfc4474bis] Section 7.2. > >Actually, this dependency on 4474bis seems odd. > >Given that the phone number construct is at the core of the work here >and this is the essential data object, and this object is presumably >intended for use outside of 4474bis, I'd expect that canonicalization >algorithm to be here. > >If 4474 needs to cite/use the algorithm, it can cite here, which it >already will have to do. There is no other normative use of 4474 in >this document. > > > >> 3.2.2.1.2. "uri" - URI identity >> >> If any of the originating or destination identities is of the form >> URI, as defined in [RFC3986], the key representing the identity >> should be "uri" URI form of the identity. > >should and not must? why? > > >> 3.2.2.1.3. Future identity forms >> >> We recognize that in the future there may be other standard >> mechanisms for representing identities. The "orig" and "dest" JSON >> >> >> >> >> Wendt & Peterson Expires January 23, 2017 [Page 6] >> ? >> Internet-Draft PASSporT July 2016 >> >> >> objects with "tn" and "uri" allow for other identity types with >> unique keys to represent these forms. > >Recognition is dandy, but where is the specification detail to support >the extensibility? > > >> 3.2.2.1.4. Examples > > *** Explain these examples, so they aren't merely syntax detail *** > > >> Single Originator to Single Destination example: >> >> { >> "dest":{"uri":["sip:alice@example.com"]}, >> "iat":"1443208345", >> "orig":{"tn":"12155551212"} >> } >> >> Single Originator to Multiple Destination Identities example: >> >> { >> "dest":{ >> "tn":["12125551212"], >> "uri":["sip:alice@example.com", >> "sip:bob@example.net"] >> }, >> "iat":"1443208345", >> "orig":{"tn":"12155551212"} >> } >> >> 3.2.2.2. "mky" - Media Key claim >> >> Some protocols that use PASSporT convey hashes for media security >> keys within their signaling in order to bind those keys to the >> identities established in the signaling layers. One example would be >> the DTLS-SRTP key fingerprints carried in SDP via the "a=3Dfingerprin= t" >> attribute; multiple instances of that fingerprint may appear in a >> single SDP body corresponding to difference media streams offered. > > difference -> different? > >The above text belongs elsewhere, explaining the overall set of >capabilities, use cases, and the like In a definitions section like >this, focus on definitions, not discussions about use. > >First use of 'SDP', with no explanation of its meaning. > >'DTLS-SRTP' citation? > >And again, how does this citation slip into a transport-independent >object signing spec? > > > >> The "mky" value of PASSporT contains a hexadecimal key presentation >> of any hash(es) necessary to establish media security via DTLS-SRTP. >> This mky value should be formated in a JSON form including the 'alg' >> and 'dig' keys with the corresponding algorithm and hexadecimal >> values. Note that per guidance of Section 5 of this document any >> whitespace and line feeds must be removed. If there is multiple > >forward pointer. Sometimes these are necessary, but in general they >impede reading comprehension. > >Redundant specification. Saying here something that is also specified >elsewhere in the document invites divergence in reader understanding. >Cite, perhaps, but do /not/ summarize. > >Is all of this summary? Anything new here? The reader can't tell. > > "If there is multiple fingerprint values, more than one,"? huh? > >Where do 'dig' and 'alg' come from? They are not explicitly introduced, >even with a citation. > > >> fingerprint values, more than one, the fingerprint values should be > >should and not must? why? > > >> constructed as a JSON array denoted by bracket characters. For the >> 'dig' key value, the hash value should be the hexadecimal value >> without any colons, in order to provide a more efficient, compact >> form to be encoded in PASSporT token claim. > >"in order to provide a more efficient, compact form" is marketing >language. It invites debate while offering no useful technical substance. > > >> An example claim with "mky" claim is as follows: >> >> For an SDP offer that includes the following fingerprint values, >> >> >> >> Wendt & Peterson Expires January 23, 2017 [Page 7] >> ? >> Internet-Draft PASSporT July 2016 >> >> >> a=3Dfingerprint:sha-256 02:1A:CC:54:27:AB:EB:9C:53:3F:3E:4B:65: >> 2E:7D:46:3F:54:42:CD:54:F1:7A:03:A2:7D:F9:B0:7F:46:19:B2 >> a=3Dfingerprint:sha-256 4A:AD:B9:B1:3F:82:18:3B:54:02:12:DF:3E: >> 5D:49:6B:19:E5:7C:AB:3E:4B:65:2E:7D:46:3F:54:42:CD:54:F1 >> >> the PASSporT Payload object would be: >> >> { >> "dest":{"uri":["sip:alice@example.com"]}, >> "iat":"1443208345", >> "mky":[ >> { >> "alg":"sha-256", >> "dig":"021ACC5427ABEB9C533F3E4B652E7D463F5442CD54 >> F17A03A27DF9B07F4619B2" >> }, >> { >> "alg":"sha-256", >> "dig":"4AADB9B13F82183B540212DF3E5D496B19E57C >> AB3E4B652E7D463F5442CD54F1" >> } >> ], >> "orig":{"tn":"12155551212"} >> } >> >> 3.3. PASSporT Signature >> >> The signature of the PASSporT is created as specified by JWS using >> the private key corresponding to the X.509 public key certificate >> referenced by the "x5u" header parameter. > >'corresponding to' vs. 'included in'? > > >> 4. Extending PASSporT >> >> PASSporT represents the bare minimum set of claims needed to assert > >represents vs. is or has? > >(FWIW, this isn't quibbling. It is an example of the difference between >regular prose writing and direct, specification language.) > > >> the originating identity and support the secure propoerties discussed >> in various parts of this document, however there will certainly be >> both new uses and ways of extending the application and usage of >> PASSPorT that requires the ability to extend the defined base set of >> claims to represent other information requiring assertion or >> validation beyond the identity itself. > >there's that 'certainly' again and this time it's predicting the future. >tsk. don't do that. also, new and extended tends towards redundancy, as >does the entire sentence's structure. I think the technical statement is: > > Passport can be extended to support additional claims. > >If you want to get really flowery, you might 'as needed' at the end... > > >> 4.1. "ppt" (PASSporT) header parameter >> >> For the extension of the base set of claims defined in this document, > > For the -> For > > >> a new JWS header parameter "ppt" MUST be used with a string that >> uniquely identifies and points to a profile specification that >> defines any new claims that would extend the base set of claims of >> PASSporT. > > extension =3D=3D profile ?? > >What is a profile of Passport? Where is this defined? > >('jws header parameter'.) > >What is the purpose of a profile and a profile label? How is it used? > > > 'identifies and points to'? what does points to mean? > > >> >> >> Wendt & Peterson Expires January 23, 2017 [Page 8] >> ? >> Internet-Draft PASSporT July 2016 >> >> >> An example header with an extended PASSporT profile of "foo" is as > > profile of -> profile name > > >> follows: >> >> { >> "alg":"ES256", >> "ppt":"foo", >> "typ":"passport", >> "x5u":"https://tel.example.org/passport.cer" >> } >> >> 4.2. Extended PASSporT Claims >> >> Future specifications that define such extensions to the PASSporT > > [Future] remove > > [such] remove. there's no context for it. > > >> mechanism MUST explicitly designate what claims they include beyond > >designate -> specify (it's defining, not appointing) > > >> the base set of claims from this document, the order in which they >> will appear, and any further information necessary to implement the >> extension. All extensions MUST incorporate the baseline JWT elements >> specified in Section 3; claims may only be appended to the claims > >If all extensions include the baseline, then 'must incorporate' is an=20 >odd way to say that > >This seems best and first handled by earlier in the spec, by providing a=20 >syntax (and text) that shows the base set and then an optional extended=20 >set. With that setup, it is clear that extensions are always /in=20 >addition to/ the base. > > >> object specified; they can never be subtracted or re-ordered. > >What does it mean to be subtracted? Perhaps 'removed'? Or are they=20 >subject to arithmetic modification? > > >> Specifying new claims follows the baseline JWT procedures ([RFC7519] >> Section 10.1). Note that understanding an extension as a verifier is >> always optional for compliance with this specification (though future > >That's not a 'note'; that's a fundamental construct. It needs to be=20 >stated much earlier and much more distinctly and as an explicitly=20 >normative assertion. > >Also, this seems to be the first reference to the verifier! > >Also we need a description of the handling of a passport object in terms=20 >of creation and consumption.) > > >> specifications or profiles for deployment environments may make other >> "ppt" values mandatory). The creator of a PASSporT object cannot >> assume that verifiers will understand any given extension. Verifiers >> that do support an extension may then trigger appropriate >> application-level behavior in the presence of an extension; authors >> of extensions should provide appropriate extension-specific guidance >> to application developers on this point. >> >> 5. Deterministic JSON Serialization >> >> In order to provide a deterministic representation of the PASSporT >> Header and Claims, particularly if PASSporT is used across multiple >> signaling environments, the JSON header object and JSON Claim object >> MUST be computed as follows. > >The implication that there can be non-deterministic representations is >pretty odd and at least needs explanation, assuming the issue is real. > > >> The JSON object MUST follow the rules for the construction of the >> thumbprint of a JSON Web Key (JWK) as defined in [RFC7638] Section 3. >> Each JSON object MUST contain no whitespace or line breaks before or >> after any syntactic elements and with the required members ordered >> lexicographically by the Unicode [UNICODE] code points of the member >> names. > >mumble. > > >> In addition, the JSON header and claim members MUST follow the >> lexicographical ordering and character and string rules defined in >> [RFC7638] Section 3.3. >> >> >> >> >> Wendt & Peterson Expires January 23, 2017 [Page 9] >> ? >> Internet-Draft PASSporT July 2016 >> >> >> 5.1. Example PASSport deterministic JSON form >> >> For the example PASSporT Payload shown in Section 3.2.2.2, the >> following is the deterministic JSON object form. >> >> {"dest":{"uri":["sip:alice@example.com"],"iat": 1443208345,"mky" >> :[{"alg":"sha-256","dig":"021ACC5427ABEB9C533F3E4B652E7D463F5442 >> CD54F17A03A27DF9B07F4619B2"},{"alg":"sha-256","dig":"4AADB9B13F8 >> 2183B540212DF3E5D496B19E57CAB3E4B652E7D463F5442CD54F1"}], >> "orig":{"tn":"12155551212"}} > >Perhaps explain the steps followed to produce this? Perhaps show the >intermediate forms? > > > >> 6. Human Readability >> >> JWT [RFC7519] and JWS [RFC7515] are defined to use Base64 and/or UTF8 >> encoding to the Header, Payload, and Signature sections. However, >> many personal communications protocols, such as SIP and XMPP, use a >> "human readable" format to allow for ease of use and ease of > >And email and FTP and HTTP and... > >Actually the use of the form has nothing to do with the purpose of the >application. As noted, it merely makes debugging and monitoring easier. > > >> operational debugging and monitoring. As such, specifications using >> PASSporT may provide guidance on whether Base64 encoding or plain >> text will be used for the construction of the PASSporT Header and >> Claim sections. > >The section is mislabeled and probably out of scope. It's trying to say >there there can be alternative encodings of this json object and that >this spec won't prohibit that happening by other specs. > >In all likelihood, this section should be removed. It doesn't specify >anything. > > >> 7. Security Considerations >> >> 7.1. Avoidance of replay and cut and paste attacks >> >> There are a number of security considerations for use of the token > >I suspect they are not 'security considerations' as much as 'mechanisms'=20 >or 'provisions' > > >> for avoidance of replay and cut and paste attacks. PASSporT tokens >> must be sent along with other application level protocol information > >Huh? You are trying to dictate application-level transport behavior? > >This smacks of layer/scoping violation. > > >> (e.g. for SIP an INVITE as defined in [RFC3261]). There should be a >> link between various information provided in the token and >> information provided by the application level protocol information. > >Why? > > >> These would include: >> >> o "iat" claim should closely correspond to a date/time the message > >The semantics of iat are defined earlier. Either there is compliance or >there isn't. The discussion here, therefore, should probably say >something like "a valid iat claim aids in detecting re-use at a later=20 >time." > > >> was originated. It should also be within a relative delta time > >What is a delta time? How is the reader to know? Where is it defined?=20 >I suspect what is meant is that it's deviation from time of origination=20 >should be small. If this has a more precise technical definition, then=20 >cite it. > > >> that is reasonable for clock drift and transmission time >> characteristics associated with the application using the PASSporT >> token. > > >> o "dest" claim is included to prevent the ability to use a >> previously originated message to send to another destination party > > the ability to -> using (or use of) > >> >> >> >> >> >> >> >> Wendt & Peterson Expires January 23, 2017 [Page 10] >> ? >> Internet-Draft PASSporT July 2016 >> >> >> 7.2. Solution Considerations >> >> It should be recognized that the use of this token should not, in >> it's own right, be considered a full solution for absolute non- >> repudiation of the persona being asserted. This only provides non- >> repudiation of the signer of PASSporT. If the signer and the persona > >huh? So the originator isn't really being validated, as claimed??? > > >> are not one in the same, which can and often will be the case in >> telecommunications networks today, protecting the destination party >> from being spoofed may take some interpretation or additional >> verification of the link between the PASSporT signature and the >> persona being asserted. >> >> In addition, the telecommunications systems and specifications that >> use PASSporT should in practice provide mechanisms for: >> >> o Managing X.509 certificates and X.509 certificate chains to an >> authorized trust anchor that can be a trusted entity to all >> participants in the telecommunications network > >Touching this sort of topic is, at the very best, redundant with >specifications devoted to X.509. Just cite them and don't attempt to >repeat them. > > >> o Accounting for entities that may route calls from other peer or >> interconnected telecommunications networks that are not part of >> the "trusted" communications network or may not be following the >> usage of PASSporT or the profile of PASSporT appropriate to that >> network > >Passport doesn't do calls. Dictating activity involving calls is out of=20 >scope. > >On the other hand, perhaps this qualifies for a discussion about=20 >transferring passport objects across administrative (trust) domain=20 >boundaries? > >At best, this section seems to be trying to compensate for the lack of a=20 >framework discussion about the problem domain and the practical uses of=20 >the various specifications being produced. > > >> o Following best practices around management and security of X.509 >> certificates > >cf, above, about redundancies. Perhaps this is the bullet that should >remain, while deleting the other one? > > >> 7.3. Privacy Considerations >> >> Because PASSporT explicity includes claims of identitifiers of > > explicity -> explicitly > > identitifiers -> identifiers > > >> parties involved in communications, times, and potentially other call >> detail, care should be taken outside of traditional protected or >> private telephony communications paths where there may be concerns >> about exposing information to either unintended or illegitimately >> intented actors. These identifiers are often exposed through many >> communications signaling protocols as of today, but appropriate >> precautions should be taken. > > intented -> intended > > >awk. > >Illegitimately intended? What does that mean? > >More fundamentally it isn't clear to me what this is really saying. > > >> 8. IANA Considerations > >This section just sits here, uncited anywhere else in the document? Each=20 >item specified should be referenced in the body of the main=20 >specification, with a pointer into this section. > > >> 8.1. Media Type Registration >> >> 8.1.1. Media Type Registry Contents Additions Requested >> >> This section registers the "application/passport" media type >> [RFC2046] in the "Media Types" registry in the manner described in >> >> >> >> >> Wendt & Peterson Expires January 23, 2017 [Page 11] >> ? >> Internet-Draft PASSporT July 2016 >> >> >> [RFC6838], which can be used to indicate that the content is a >> PASSporT defined JWT and JWS. >> >> o Type name: application >> >> o Subtype name: passport >> >> o Required parameters: n/a >> >> o Optional parameters: n/a >> >> o Encoding considerations: 8bit; application/passport values outside >> the US-ASCII range are encoded using percent encoding as described >> in section 2.1 of RFC 3986 (some values may be the empty string), >> each separated from the next by a single period ('.') character. >> >> o Security considerations: See the Security Considerations section >> of RFC 7515. >> >> o Interoperability considerations: n/a >> >> o Published specification: draft-ietf-stir-passport-05 >> >> o Applications that use this media type: STIR and other applications >> that require identity related assertion >> >> o Fragment identifier considerations: n/a >> >> o Additional information: >> >> * Magic number(s): n/a >> >> * File extension(s): n/a >> >> * Macintosh file type code(s): n/a >> >> o Person and email address to contact for further information: Chris >> Wendt, chris-ietf@chriswendt.net >> >> o Intended usage: COMMON >> >> o Restrictions on usage: none >> >> o Author: Chris Wendt, chris-ietf@chriswendt.net >> >> o Change Controller: IESG >> >> o Provisional registration? No >> >> >> >> Wendt & Peterson Expires January 23, 2017 [Page 12] >> ? >> Internet-Draft PASSporT July 2016 >> >> >> 8.2. JSON Web Token Claims Registration >> >> 8.2.1. Registry Contents Additions Requested >> >> o Claim Name: "orig" >> >> o Claim Description: Originating Identity String >> >> o Change Controller: IESG >> >> o Specification Document(s): Section 3.2 of draft-ietf-stir- >> passport-05 >> >> o Claim Name: "dest" >> >> o Claim Description: Destination Identity String >> >> o Change Controller: IESG >> >> o Specification Document(s): Section 3.2 of draft-ietf-stir- >> passport-05 >> >> o Claim Name: "mky" >> >> o Claim Description: Media Key Fingerprint String >> >> o Change Controller: IESG >> >> o Specification Document(s): Section 3.2 of draft-ietf-stir- >> passport-05 >> >> 9. Acknowledgements >> >> Particular thanks to members of the ATIS and SIP Forum NNI Task Group >> including Jim McEchern, Martin Dolly, Richard Shockey, John Barnhill, >> Christer Holmberg, Victor Pascual Avila, Mary Barnes, Eric Burger for >> their review, ideas, and contributions also thanks to Henning >> Schulzrinne, Russ Housley, Alan Johnston, Richard Barnes, Mark >> Miller, and Ted Hardie for valuable feedback on the technical and >> security aspects of the document. Additional thanks to Harsha Bellur >> for assistance in coding the example tokens. >> >> 10. References >> >> >> >> >> >> >> >> >> Wendt & Peterson Expires January 23, 2017 [Page 13] >> ? >> Internet-Draft PASSporT July 2016 >> >> >> 10.1. Normative References >> >> [I-D.ietf-stir-rfc4474bis] >> Peterson, J., Jennings, C., Rescorla, E., and C. Wendt, >> "Authenticated Identity Management in the Session >> Initiation Protocol (SIP)", draft-ietf-stir-rfc4474bis-10 >> (work in progress), July 2016. >> >> [RFC2046] Freed, N. and N. Borenstein, "Multipurpose Internet Mail >> Extensions (MIME) Part Two: Media Types", RFC 2046, >> DOI 10.17487/RFC2046, November 1996, >> . >> >> [RFC3986] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform >> Resource Identifier (URI): Generic Syntax", STD 66, >> RFC 3986, DOI 10.17487/RFC3986, January 2005, >> . >> >> [RFC6838] Freed, N., Klensin, J., and T. Hansen, "Media Type >> Specifications and Registration Procedures", BCP 13, >> RFC 6838, DOI 10.17487/RFC6838, January 2013, >> . >> >> [RFC7515] Jones, M., Bradley, J., and N. Sakimura, "JSON Web >> Signature (JWS)", RFC 7515, DOI 10.17487/RFC7515, May >> 2015, . >> >> [RFC7518] Jones, M., "JSON Web Algorithms (JWA)", RFC 7518, >> DOI 10.17487/RFC7518, May 2015, >> . >> >> [RFC7519] Jones, M., Bradley, J., and N. Sakimura, "JSON Web Token >> (JWT)", RFC 7519, DOI 10.17487/RFC7519, May 2015, >> . >> >> [RFC7638] Jones, M. and N. Sakimura, "JSON Web Key (JWK) >> Thumbprint", RFC 7638, DOI 10.17487/RFC7638, September >> 2015, . >> >> [UNICODE] "The Unicode Consortium, "The Unicode Standard"", >> . >> >> 10.2. Informative References >> >> >> >> >> >> >> >> >> Wendt & Peterson Expires January 23, 2017 [Page 14] >> ? >> Internet-Draft PASSporT July 2016 >> >> >> [RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, >> A., Peterson, J., Sparks, R., Handley, M., and E. >> Schooler, "SIP: Session Initiation Protocol", RFC 3261, >> DOI 10.17487/RFC3261, June 2002, >> . >> >> [RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S., >> Housley, R., and W. Polk, "Internet X.509 Public Key >> Infrastructure Certificate and Certificate Revocation List >> (CRL) Profile", RFC 5280, DOI 10.17487/RFC5280, May 2008, >> . >> >> [RFC7340] Peterson, J., Schulzrinne, H., and H. Tschofenig, "Secure >> Telephone Identity Problem Statement and Requirements", >> RFC 7340, DOI 10.17487/RFC7340, September 2014, >> . >> >> Appendix A. Example PASSporT JWS Serialization and Signature >> >> For PASSporT, there will always be a JWS with the following members: >> >> o "protected", with the value BASE64URL(UTF8(JWS Protected Header)) >> >> o "payload", with the value BASE64URL (JWS Payload) >> >> o "signature", with the value BASE64URL(JWS Signature) >> >> Note: there will never be a JWS Unprotected Header for PASSporT. >> >> First, an example PASSporT Protected Header is as follows: >> >> { >> "typ":"passport", >> "alg":"ES256", >> "x5u":"https://cert.example.org/passport.cer" >> } >> >> This would be serialized to the form: >> >> {"alg":"ES256","typ":"passport","x5u":"https://cert.example.org/ >> passport.cer"} >> >> Encoding this with UTF8 and BASE64 encoding produces this value: >> >> eyJhbGciOiJFUzI1NiIsInR5cCI6InBhc3Nwb3J0IiwieDV1IjoiaHR0cHM6Ly9j >> ZXJ0LmV4YW1wbGUub3JnL3Bhc3Nwb3J0LmNlciJ9 >> >> Second, an example PASSporT Payload is as follows: >> >> >> >> Wendt & Peterson Expires January 23, 2017 [Page 15] >> ? >> Internet-Draft PASSporT July 2016 >> >> >> { >> "dest":{"uri":["sip:alice@example.com"]} >> "iat":"1443208345", >> "orig":{"tn":"12155551212"} >> } >> >> This would be serialized to the form: >> >> {"dest":{"uri":["sip:alice@example.com"]},"iat":"1443208345", >> "orig":{"tn":"12155551212"}} >> >> Encoding this with the UTF8 and BASE64 encoding produces this value: >> >> eyJkZXN0Ijp7InVyaSI6WyJzaXA6YWxpY2VAZXhhbXBsZS5jb20iXX0sImlhd >> CI6IjE0NDMyMDgzNDUiLCJvcmlnIjp7InRuIjoiMTIxNTU1NTEyMTIifX0 >> >> Computing the digital signature of the PASSporT Signing Input >> ASCII(BASE64URL(UTF8(JWS Protected Header)) || '.' || BASE64URL(JWS >> Payload)) >> >> rq3pjT1hoRwakEGjHCnWSwUnshd0-zJ6F1VOgFWSjHBr8Qjpjlk-cpFYpFYso >> jNCpTzO3QfPOlckGaS6hEck7w >> >> The final PASSporT token is produced by concatenating the values in >> the order Header.Payload.Signature with period (',') characters. For >> the above example values this would produce the following: >> >> eyJhbGciOiJFUzI1NiIsInR5cCI6InBhc3Nwb3J0IiwieDV1IjoiaHR0cHM6Ly >> 9jZXJ0LmV4YW1wbGUub3JnL3Bhc3Nwb3J0LmNlciJ9 >> . >> eyJkZXN0Ijp7InVyaSI6WyJzaXA6YWxpY2VAZXhhbXBsZS5jb20iXX0sImlhd >> CI6IjE0NDMyMDgzNDUiLCJvcmlnIjp7InRuIjoiMTIxNTU1NTEyMTIifX0 >> . >> rq3pjT1hoRwakEGjHCnWSwUnshd0-zJ6F1VOgFWSjHBr8Qjpjlk-cpFYpFYso >> jNCpTzO3QfPOlckGaS6hEck7w >> >> A.1. X.509 Private Key Certificate for Example >> >> -----BEGIN EC PRIVATE KEY----- >> MHcCAQEEIFeZ1R208QCvcu5GuYyMfG4W7sH4m99/7eHSDLpdYllFoAoGCCqGSM49 >> AwEHoUQDQgAE8HNbQd/TmvCKwPKHkMF9fScavGeH78YTU8qLS8I5HLHSSmlATLcs >> lQMhNC/OhlWBYC626nIlo7XeebYS7Sb37g=3D=3D >> -----END EC PRIVATE KEY----- >> >> >> >> >> >> >> >> >> Wendt & Peterson Expires January 23, 2017 [Page 16] >> ? >> Internet-Draft PASSporT July 2016 >> >> >> A.2. X.509 Public Key Certificate for Example >> >> -----BEGIN PUBLIC KEY----- >> MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE8HNbQd/TmvCKwPKHkMF9fScavGeH >> 78YTU8qLS8I5HLHSSmlATLcslQMhNC/OhlWBYC626nIlo7XeebYS7Sb37g=3D=3D >> -----END PUBLIC KEY----- >> >> Authors' Addresses >> >> Chris Wendt >> Comcast >> One Comcast Center >> Philadelphia, PA 19103 >> USA >> >> Email: chris-ietf@chriswendt.net >> >> >> Jon Peterson >> Neustar Inc. >> 1800 Sutter St Suite 570 >> Concord, CA 94520 >> US >> >> Email: jon.peterson@neustar.biz >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> Wendt & Peterson Expires January 23, 2017 [Page 17] > >--=20 > > Dave Crocker > Brandenburg InternetWorking > bbiw.net > >--=20 > > Dave Crocker > Brandenburg InternetWorking > bbiw.net > >_______________________________________________ >stir mailing list >stir@ietf.org >https://www.ietf.org/mailman/listinfo/stir From nobody Fri Jul 29 10:28:00 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 66EDB12B012 for ; Fri, 29 Jul 2016 10:27:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.107 X-Spam-Level: X-Spam-Status: No, score=-1.107 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RDNS_NONE=0.793] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id roGA5P-KMR3c for ; Fri, 29 Jul 2016 10:27:57 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 50567127078 for ; Fri, 29 Jul 2016 10:27:57 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u6THSepK020710 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Fri, 29 Jul 2016 10:28:41 -0700 To: "Peterson, Jon" , IETF STIR Mail List References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: Date: Fri, 29 Jul 2016 10:27:49 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [stir] Review of: draft-ietf-stir-passport-05 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Jul 2016 17:27:58 -0000 On 7/29/2016 10:12 AM, Peterson, Jon wrote: > We had a major intervention in the work last fall to the effect that we > need to build more generically for real-time communications rather than > just SIP. I'm not clear what this means. Can you point to the record of this intervention? And how it changes the technical requirements? And how the current specifications are responsive to that change in scope? And since the scope was changed, why wasn't the charter: The STIR working group will specify Internet-based mechanisms that allow verification of the calling party's authorization to use a particular telephone number for an incoming call. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Fri Jul 29 10:46:55 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CD8AB12D624 for ; Fri, 29 Jul 2016 10:46:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.601 X-Spam-Level: X-Spam-Status: No, score=-102.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9QtRt6u3XJ4K for ; Fri, 29 Jul 2016 10:46:52 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0b-0018ba01.pphosted.com [67.231.157.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1E8B212D182 for ; Fri, 29 Jul 2016 10:46:52 -0700 (PDT) Received: from pps.filterd (m0049401.ppops.net [127.0.0.1]) by m0049401.ppops.net-0018ba01. (8.16.0.17/8.16.0.17) with SMTP id u6THgoNG018210; Fri, 29 Jul 2016 13:46:49 -0400 Received: from stntexhc12.cis.neustar.com ([156.154.17.216]) by m0049401.ppops.net-0018ba01. with ESMTP id 24c4wc6fta-1 (version=TLSv1 cipher=AES128-SHA bits=128 verify=NOT); Fri, 29 Jul 2016 13:46:48 -0400 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.94]) by stntexhc12.cis.neustar.com ([::1]) with mapi id 14.03.0279.002; Fri, 29 Jul 2016 13:46:48 -0400 From: "Peterson, Jon" To: "dcrocker@bbiw.net" , IETF STIR Mail List Thread-Topic: [stir] Review of: draft-ietf-stir-passport-05 Thread-Index: AQHR6Pa+qcjKJ8B9hE+IbOWpflw+YqAwC2aA///iyICAACbTAA== Date: Fri, 29 Jul 2016 17:46:48 +0000 Message-ID: References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.6.3.160329 x-originating-ip: [10.96.13.16] Content-Type: text/plain; charset="us-ascii" Content-ID: <383604DDD16AC64BB903A7153B652C7F@neustar.biz> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-07-29_12:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1607290176 Archived-At: Subject: Re: [stir] Review of: draft-ietf-stir-passport-05 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Jul 2016 17:46:54 -0000 I wouldn't say it's a correction to the STIR charter - the charter was always clear that it was not limited to SIP (see the bits about "one or more non-SIP hops" and "out-of-band mechanism" in the charter). But given that our original signing mechanism was, as I said, a concatenation of SIP header field values, the intervention was that other protocols would need something less bound to SIP. JWT turned out to be the solution that the group had consensus to adopt. If you want a record of this intervention, I might point you to the Oct 9 2015 virtual interim where this was the focus: https://www.ietf.org/mail-archive/web/stir/current/msg02140.html ... and then the intense list discussion that followed hard upon it. This is turn led to some design team calls, and so on. It was not a particularly isolated or unconsidered decision. Jon Peterson Neustar, Inc. On 7/29/16, 7:27 PM, "Dave Crocker" wrote: >On 7/29/2016 10:12 AM, Peterson, Jon wrote: >> We had a major intervention in the work last fall to the effect that we >> need to build more generically for real-time communications rather than >> just SIP. > > >I'm not clear what this means. Can you point to the record of this >intervention? And how it changes the technical requirements? And how >the current specifications are responsive to that change in scope? > >And since the scope was changed, why wasn't the charter: > > The STIR working group will specify Internet-based mechanisms that >allow verification of the calling party's authorization to use a >particular telephone number for an incoming call. > > > >d/ >--=20 > > Dave Crocker > Brandenburg InternetWorking > bbiw.net From nobody Fri Jul 29 14:11:59 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EC11012D89E for ; Fri, 29 Jul 2016 14:11:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.107 X-Spam-Level: X-Spam-Status: No, score=-1.107 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RDNS_NONE=0.793] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LNCreoYUgIYM for ; Fri, 29 Jul 2016 14:11:46 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6498112D891 for ; Fri, 29 Jul 2016 14:11:30 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u6TLCE1C030607 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Fri, 29 Jul 2016 14:12:14 -0700 To: "Peterson, Jon" References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: Date: Fri, 29 Jul 2016 14:11:22 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] Review of: draft-ietf-stir-passport-05 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Jul 2016 21:11:47 -0000 Jon, On 7/29/2016 10:46 AM, Peterson, Jon wrote: > I wouldn't say it's a correction to the STIR charter - the charter was > always clear that it was not limited to SIP (see the bits about "one or > more non-SIP hops" and "out-of-band mechanism" in the charter). But given > that our original signing mechanism was, as I said, a concatenation of SIP > header field values, the intervention was that other protocols would need > something less bound to SIP. JWT turned out to be the solution that the > group had consensus to adopt. JWT has nothing to do with SIP. So when applied to a SIP context, it's entirely artificial. And yes, I noted the views that thought it simpler or equivalent to the computed string, but could not see the explicit logic that made JWT a better choice, no does it seem obvious to me. Quite the contrary. Note that during the wg session in Berlin there was /still/ question about where to put the JWT information. > If you want a record of this intervention, I might point you to the Oct 9 > 2015 virtual interim where this was the focus: > > https://www.ietf.org/mail-archive/web/stir/current/msg02140.html > > > ... and then the intense list discussion that followed hard upon it. The recording of that interim is not accessible and the very terse summary text of the session show nothing about an intervention. And there was no mailing list activity for the next several days afterward. Nor do I see anything in the mailing list postings that /do/ show up those several days later. So I've no idea what you meant by "hard upon it." Hence your explanation: "we need to build more generically for real-time communications rather than just SIP." does not seem to reflected in the wg record. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Fri Jul 29 14:56:54 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4CAFD12D0C0 for ; Fri, 29 Jul 2016 14:56:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.601 X-Spam-Level: X-Spam-Status: No, score=-102.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1vKW-sXrGzPv for ; Fri, 29 Jul 2016 14:56:51 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0a-0018ba01.pphosted.com [67.231.149.94]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5E8A012D5BE for ; Fri, 29 Jul 2016 14:56:51 -0700 (PDT) Received: from pps.filterd (m0078666.ppops.net [127.0.0.1]) by mx0a-0018ba01.pphosted.com (8.16.0.17/8.16.0.17) with SMTP id u6TLr9rV031552; Fri, 29 Jul 2016 17:56:49 -0400 Received: from stntexhc10.cis.neustar.com ([156.154.17.216]) by mx0a-0018ba01.pphosted.com with ESMTP id 24c4pqp3k9-1 (version=TLSv1 cipher=AES128-SHA bits=128 verify=NOT); Fri, 29 Jul 2016 17:56:49 -0400 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.94]) by stntexhc10.cis.neustar.com ([169.254.4.225]) with mapi id 14.03.0279.002; Fri, 29 Jul 2016 17:56:48 -0400 From: "Peterson, Jon" To: "dcrocker@bbiw.net" Thread-Topic: [stir] Review of: draft-ietf-stir-passport-05 Thread-Index: AQHR6Pa+qcjKJ8B9hE+IbOWpflw+YqAwC2aA///iyICAACbTAIAAF6MAgAAuNYA= Date: Fri, 29 Jul 2016 21:56:48 +0000 Message-ID: References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.6.3.160329 x-originating-ip: [10.96.13.16] Content-Type: text/plain; charset="us-ascii" Content-ID: <0C336C529FF2BB4699A99F7A3CB30A53@neustar.biz> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-07-29_14:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1607290218 Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] Review of: draft-ietf-stir-passport-05 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Jul 2016 21:56:53 -0000 >JWT has nothing to do with SIP. So when applied to a SIP context, it's >entirely artificial. And yes, I noted the views that thought it simpler >or equivalent to the computed string, but could not see the explicit >logic that made JWT a better choice, no does it seem obvious to me. >Quite the contrary. The only thing JWT has to do with SIP is that JWT can be a container for a signed set of metadata and claims that might be useful in preventing impersonation in a SIP request. JWT was chosen not because it has any exclusive or special applicability to SIP, but instead because it could have applicability both to SIP and other protocols. I'm not sure I see much value in revisiting that consensus call, but I'm sure the chairs could call it again if they see fit. >Note that during the wg session in Berlin there was /still/ question >about where to put the JWT information. Kind of. It was a question about the best syntax for transporting only part of a JWT object, and was as much a discussion about "if" as "where". But that technical choice does not imply any discomfiture with JWT itself. >> If you want a record of this intervention, I might point you to the Oct >>9 >> 2015 virtual interim where this was the focus: >> >> https://www.ietf.org/mail-archive/web/stir/current/msg02140.html >> >> >> ... and then the intense list discussion that followed hard upon it. > >The recording of that interim is not accessible and the very terse >summary text of the session show nothing about an intervention. The "intervention" is reflected in the summary text: "Chris Wendt introduced the verified token being discussed in the IP-NNI task force." That "verified token" was an early form of PASSporT, introducing a JWT-based assertion. Then we can observe how "conversation focused on the differences and similarities in what the signatures in the verified token and RFC4474bis Identity header protected," where the latter option then was the concatenated string I've mentioned. We made a decision there to try to merge these into the core proposal, as the summary reads "An open design team was formed to discuss finding a common way to address the signaling." The design team than proceeded. > And=20 >there was no mailing list activity for the next several days afterward. You are absolutely correct that there were no submissions to the STIR mailing list immediately following the interim on Friday October 9. Not a single related email went out on Saturday the 10th, Sunday the 11th, or even Monday October 12th (which, incidentally, was Columbus Day). Then, on the 13th, the only mail that went out announced that the Doodle poll for the design team had (behind the scenes) resolved, and that its first meeting would be that coming Friday, the 16th. The day of that design call there were 44 messages sent to the list on related subjects. >=20 >Nor do I see anything in the mailing list postings that /do/ show up >those several days later. I can imagine that since I had to annotate even the summary text of the interim meeting in order to show how it related to this topic, it might not be clear from the threads on encoding, the NNI and so on how they were salient to these decisions if you weren't participating in the WG at the time. Maybe looking at the design team minutes for Oct 16th would be clearer? It at least mentioned JWT explicitly. https://www.ietf.org/mail-archive/web/stir/current/msg02183.html >So I've no idea what you meant by "hard upon it." I understand you feel that progress should have been more immediate to justify my characterization. >Hence your explanation: > > "we need to build more generically for real-time communications >rather than just SIP." > >does not seem to reflected in the wg record. Maybe you'll find the Oct 16th design team minutes clearer on this point. Or maybe they too would require more annotation to clarify the subject and thinking of the working group after the fact. The discussions that they reflect, anyway, were sufficient to drive consensus at the time. Jon Peterson Neustar, Inc. From nobody Fri Jul 29 16:59:40 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E641912D144 for ; Fri, 29 Jul 2016 16:59:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.107 X-Spam-Level: X-Spam-Status: No, score=-1.107 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RDNS_NONE=0.793] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id S8CpHOb89Z7A for ; Fri, 29 Jul 2016 16:59:38 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7A5F612B060 for ; Fri, 29 Jul 2016 16:59:38 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u6U00MNE003665 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Fri, 29 Jul 2016 17:00:22 -0700 To: "Peterson, Jon" References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: Date: Fri, 29 Jul 2016 16:59:30 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] Review of: draft-ietf-stir-passport-05 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Jul 2016 23:59:40 -0000 Jon, On 7/29/2016 2:56 PM, Peterson, Jon wrote: > The only thing JWT has to do with SIP is that JWT can be a container for a > signed set of metadata and claims that might be useful in preventing > impersonation in a SIP request. JWT was chosen not because it has any > exclusive or special applicability to SIP, but instead because it could > have applicability both to SIP and other protocols. Sorry to be repetitious but I do not see that case made, discussed or agreed to in the working group record. What I did see was a repeated claim that using JWT was simpler, which I suspect is quite simply wrong, if only because it requires more mechanism that directly adding the necessary information to a SIP header field. (cf, DKIM, of course.) >> Note that during the wg session in Berlin there was /still/ question >> about where to put the JWT information. > > Kind of. It was a question about the best syntax for transporting only And there's the rub. At this stage of the effort, after 3 years of wg effort, and given three major drafts in wg Last Call, something as basic as how to carry the necessary information for its primary use case is not settled yet. That's quite troubling, both in general and, given the importance and urgency of that motivating use case, in particular. >> The recording of that interim is not accessible and the very terse >> summary text of the session show nothing about an intervention. > > The "intervention" is reflected in the summary text: "Chris Wendt > introduced the verified token being discussed in the IP-NNI task force." Sorry to belabor this but how does 'introducing' something equate to "a major intervention in the work last fall to the effect that we need to build more generically for real-time communications rather than just SIP. We're interested in getting this to work properly with WebRTC..."? > We made a decision there to > try to merge these into the core proposal, as the summary reads "An open > design team was formed to discuss finding a common way to address the > signaling." Ahh, so that's what that was intended to mean. Except that while the word 'signaling' does show up in the messages at that time, it doesn't seem to apply to this point. > You are absolutely correct that there were no submissions to the STIR > mailing list immediately following the interim on Friday October 9. Not a > single related email went out on Saturday the 10th, Sunday the 11th, or > even Monday October 12th (which, incidentally, was Columbus Day). Then, on > the 13th, the only mail that went out announced that the Doodle poll for > the design team had (behind the scenes) resolved, and that its first > meeting would be that coming Friday, the 16th. The day of that design call > there were 44 messages sent to the list on related subjects. So, I think I understand the general idea behind 'claims' in a larger context of transactions and reputations. As a general model for making and maybe validating a variety of assertions /about/ an entity, it's probably a reasonable approach, although the pragmatics of its application at Internet scale are arguably unproven. However the task of authenticating the proper use of an identifier in a field is a rather more constrained requirement. And there are a number of operational examples, which happen not to require a general claims model. Simply put, the task is to take an identifier, bind it to the object that is relevant (such as a SIP Invite), where the binding mechanism requires a basic demonstration of 'approval' of the identifier's use, from the authority responsible for administering the identifier. That really is all there is to the required semantics. Things only get complicated when the goal is made more general (which I don't see prompted by the working group charter.) >> Nor do I see anything in the mailing list postings that /do/ show up >> those several days later. > > I can imagine that since I had to annotate even the summary text of the > interim meeting in order to show how it related to this topic, it might > not be clear from the threads on encoding, the NNI and so on how they were > salient to these decisions if you weren't participating in the WG at the > time. Maybe looking at the design team minutes for Oct 16th would be > clearer? It at least mentioned JWT explicitly. I had already looked at those notes. They didn't help. There is nothing I saw that made this expanded scope obvious, nevermind justified. > > https://www.ietf.org/mail-archive/web/stir/current/msg02183.html > >> So I've no idea what you meant by "hard upon it." > > I understand you feel that progress should have been more immediate to > justify my characterization. > >> Hence your explanation: >> >> "we need to build more generically for real-time communications >> rather than just SIP." >> >> does not seem to reflected in the wg record. > > Maybe you'll find the Oct 16th design team minutes clearer on this point. > Or maybe they too would require more annotation to clarify the subject and > thinking of the working group after the fact. The discussions that they > reflect, anyway, were sufficient to drive consensus at the time. Sorry. I still don't see any discussion on the list for the specific requirement of other uses. Lots of discussion about delegation -- including one suggesting a lack of requirement for a 'nicely engineered, convoluted, infinitely extensible, handles all corner cases certificate delegation model' -- but not for the expanded scope I am asking after. So perhaps it was agreed to by the group in the same fashion that was apparently going to be expressed for the current draft during the Last Call, namely silence. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Fri Jul 29 18:44:19 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C83C712D13B for ; Fri, 29 Jul 2016 18:44:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.601 X-Spam-Level: X-Spam-Status: No, score=-102.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Kw0jrjmGTPfA for ; Fri, 29 Jul 2016 18:44:16 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0b-0018ba01.pphosted.com [67.231.157.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4849A12B029 for ; Fri, 29 Jul 2016 18:44:16 -0700 (PDT) Received: from pps.filterd (m0049401.ppops.net [127.0.0.1]) by m0049401.ppops.net-0018ba01. (8.16.0.17/8.16.0.17) with SMTP id u6U1iDdT020346; Fri, 29 Jul 2016 21:44:13 -0400 Received: from stntexhc10.cis.neustar.com ([156.154.17.216]) by m0049401.ppops.net-0018ba01. with ESMTP id 24c4wc7atx-1 (version=TLSv1 cipher=AES128-SHA bits=128 verify=NOT); Fri, 29 Jul 2016 21:44:12 -0400 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.94]) by stntexhc10.cis.neustar.com ([169.254.4.225]) with mapi id 14.03.0279.002; Fri, 29 Jul 2016 21:44:11 -0400 From: "Peterson, Jon" To: "dcrocker@bbiw.net" Thread-Topic: [stir] Review of: draft-ietf-stir-passport-05 Thread-Index: AQHR6Pa+qcjKJ8B9hE+IbOWpflw+YqAwC2aA///iyICAACbTAIAAF6MAgAAuNYCAAADFAIAAPsMA Date: Sat, 30 Jul 2016 01:44:11 +0000 Message-ID: References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.6.3.160329 x-originating-ip: [10.96.13.16] Content-Type: text/plain; charset="us-ascii" Content-ID: <7AC2612CC953CC45BF5296F97914641E@neustar.biz> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-07-30_01:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1607300016 Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] Review of: draft-ietf-stir-passport-05 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 30 Jul 2016 01:44:18 -0000 >> JWT was chosen not because it has any >> exclusive or special applicability to SIP, but instead because it could >> have applicability both to SIP and other protocols. > >Sorry to be repetitious but I do not see that case made, discussed or >agreed to in the working group record. So, the summary of the virtual interim states that the original JWT verified token approach was compared with the concatenated string, but since it does not say in which specific respects they were compared, then I gather that this "working group record" is not sufficient for you to believe that we ever considered the applicability of JWT to multiple protocols in particular? Well, what if the original verified token I-D stated that a goal of the work "is to be separable from any specific signaling call logic, so creation and verification of information can be implemented in a flexible way with minimal dependence on specific signaling constructs." Maybe that's not good enough, the wording is a little wild. Perhaps it could come through a bit more clearly in passport-05, if it stated a goal that PASSporT be "independent of any specific personal communications signaling call logic, so that creation and verification of persona information can be implemented in a flexible way and can be used in many personal communications applications including end-to-end applications that require different signaling protocols." But we're jumping the gun here - when and where was this principle vetted in the working group, to measure whether or not such language belonged in a WG draft? How about if the slides on verified token in the Oct 9 virtual interim included a bullet on how the "separation of the token to signaling specific attributes" has the additional benefit of "applicability to future RTC applications and signaling protocols" (those slides are in the virtual interim proceedings). Still, that could be (ungenerously) read to mean exclusively future protocols, not currently existing ones. So what if the slides that Chris and I sent out for the Oct 16 design team meeting contained a slide called "Not So SIP Specific" that discusses the JWT surviving gateway SIP->XMPP calls as a design goal, and even enabling end-to-end SRTP through a gateway? That same design team slide would need to have been presented in Yokohama at the STIR WG meeting for the confirmation of the working group, of course. Actually, not only was that "Not So SIP Specific" slide reproduced (and presented), but the very first slide my presentation there talked about "a new (well, resurrected) requirement" that the "signature should be transportable outside of SIP" and observes that that wasn't really possible with RFC4474bis before PASSporT. You can read the proceedings/minutes of that discussion - oh wait, you were there, I see your name in the minutes, actually. The minutes also note that Adam Roach expressed interest in using STIR for RTCWeb in particular, so I could furthermore point to Cullen's recent draft (draft-jennings-stir-rtcweb-identity-00) as a "working group record" of our multi-protocol direction, though admittedly that hasn't been discussed outside of the RTCWeb working group - we're trying to get this core work done before we start nailing down the applicability to other protocols, as our charter effectively requires us to do the SIP using protocol for PASSporT first. And lastly, I do seem to recall concluding the STIR working group meeting in Berlin by advertising the forthcoming pivot to these out-of-band use cases. I don't think we need to meet this unusual bar for "working group record" evidence that the case for JWT's applicability to multiple protocols was made, or discussed, or agreed to - though I suspect we would happen to meet it. More importantly, we have agreement among interested and active parties on the PASSporT approach that has led to some initial implementation - or as they call it around here, rough consensus and running code. >What I did see was a repeated claim that using JWT was simpler, which I >suspect is quite simply wrong, if only because it requires more >mechanism that directly adding the necessary information to a SIP header >field. (cf, DKIM, of course.) At last we have identified the root problem here: we didn't use DKIM. I should have guessed - you brought it up in Yokohama too, as I see in the STIR minutes. DKIM was an option we considered for SIP a long time ago... around the time that Domain Keys and IIM were merging, if I recall, though I doubt I could find you a "working group record" of that decision back when RFC4474 was under development. I do see some record that we discussed at least one of aspect of the trade-off between DKIM and PASSporT in Yokohama, but it doesn't seem to have undermined our consensus to use PASSporT. I see no reason to give this much further consideration. Jon Peterson Neustar, Inc. From nobody Sat Jul 30 04:30:29 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9EF4312D946 for ; Sat, 30 Jul 2016 04:30:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.22 X-Spam-Level: X-Spam-Status: No, score=-4.22 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3O71F5jP6MX9 for ; Sat, 30 Jul 2016 04:30:25 -0700 (PDT) Received: from sesbmg22.ericsson.net (sesbmg22.ericsson.net [193.180.251.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E7A0112D933 for ; Sat, 30 Jul 2016 04:30:24 -0700 (PDT) X-AuditID: c1b4fb30-ea88e980000009f9-17-579c8fce97bf Received: from ESESSHC018.ericsson.se (Unknown_Domain [153.88.183.72]) by (Symantec Mail Security) with SMTP id DC.C7.02553.ECF8C975; Sat, 30 Jul 2016 13:30:23 +0200 (CEST) Received: from ESESSMB209.ericsson.se ([169.254.9.142]) by ESESSHC018.ericsson.se ([153.88.183.72]) with mapi id 14.03.0301.000; Sat, 30 Jul 2016 13:30:20 +0200 From: Christer Holmberg To: "dcrocker@bbiw.net" , "Peterson, Jon" Thread-Topic: [stir] Review of: draft-ietf-stir-passport-05 Thread-Index: AQHR6Pa8IhcNFBWCX0CjWpL6ATcrHqAvhU6AgAAES4CAAAVOAIAAOSgAgAAMsQCAACJJAIAA4os4 Date: Sat, 30 Jul 2016 11:30:20 +0000 Message-ID: <7594FB04B1934943A5C02806D1A2204B476FE6CB@ESESSMB209.ericsson.se> References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> , In-Reply-To: Accept-Language: en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: multipart/alternative; boundary="_000_7594FB04B1934943A5C02806D1A2204B476FE6CBESESSMB209erics_" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprEIsWRmVeSWpSXmKPExsUyM2K7h+75/jnhBp1XmS1+f/rAZnGmwdJi +dptTA7MHpd2nmTzWLLkJ5PHjobnzAHMUVw2Kak5mWWpRfp2CVwZ7b+WMRe8nsBYsffcV8YG xldlXYycHBICJhKf3z5n7GLk4hASWM8osf/bXnYIZwmjxJXLl5i6GDk42AQsJLr/aYM0iAhE Srz6eYEdxGYWUJd48egNmC0sYCWxd9UxNpByEQFrifszJSHKoyQuvrzACGKzCKhKLO16ygRi 8wr4Sty5eA1q7zMmiT/TNrKAJDgFHCTmHHsFNpNRQEzi+6k1TBC7xCWavqxkhThaQGLJnvPM ELaoxMvH/1ghavIlNj6bwwKxQFDi5MwnLBMYhWchaZ+FpGwWkjKIuIHEl/e3oWxtiWULXzND 2PoS3e9PMyGLL2BkX8UoWpxanJSbbmSkl1qUmVxcnJ+nl5dasokRGFMHt/w22MH48rnjIUYB DkYlHt4FM2eHC7EmlhVX5h5ilOBgVhLhXdUzJ1yINyWxsiq1KD++qDQntfgQozQHi5I4r/9L xXAhgfTEktTs1NSC1CKYLBMHp1QDo0f69uZ7rFPfPAkoltq+kOfjaenG5RyHAoKuqf89Gv++ w/dmqsDRW9WePW6K1ntUij/c13OUfLBrnfO0H3zb//3S+7O8KYeJ8Znez/zwFO3Jpo09t7Ri D8cpZi6w3LespjN41pnINb6z42am9Vsa9V2brfJf9P9F7tslD6zrbNSsVPpfSO9sU2Ipzkg0 1GIuKk4EACa2IBmlAgAA Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] Review of: draft-ietf-stir-passport-05 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 30 Jul 2016 11:30:27 -0000 --_000_7594FB04B1934943A5C02806D1A2204B476FE6CBESESSMB209erics_ Content-Type: text/plain; charset="windows-1256" Content-Transfer-Encoding: quoted-printable Hi Dave, I am the one who originally suggested the usage of JWT. I don't understand = the claim that JWT is "outside the context of SIP". JWT is a generic/standa= rdized mechanism how to calculate and encode a signature, and that is the r= eason I suggested it - not because I saw usage outside of SIP, or because I= wanted to extend the scope of the charter. I see no reason why JWT can't b= e used by SIP. If we would NOT use JWT we would probably have to define mor= e STIR-specific procedures regarding the calculating/encoding of the signat= ure ourselves. It's better to use a standardized mechanism in my opinion. I am also the one who raised the encoding issue in Berlin. But that was not= related to the usage of JWT as such, but to the fact that we don't carry t= he encoded JWT object in one piece in the SIP message. We "split" the objec= t into two pieces, and carry one piece as the Identity header field value, = and the other piece as the canon header field parameter value. I questioned= that, and commented that we, if we want to do it that way, need more detai= ls on how the "split" is done and how the resulting parts are encoded. Jon = promised to add more text to cover those comments. Also note that my comme= nt was not related to draft-passport, but to draft-4474bis. Regards, Christer Sent from my Windows Phone ________________________________ From: Dave Crocker Sent: =FD30/=FD07/=FD2016 02:59 To: Peterson, Jon Cc: IETF STIR Mail List Subject: Re: [stir] Review of: draft-ietf-stir-passport-05 Jon, On 7/29/2016 2:56 PM, Peterson, Jon wrote: > The only thing JWT has to do with SIP is that JWT can be a container for = a > signed set of metadata and claims that might be useful in preventing > impersonation in a SIP request. JWT was chosen not because it has any > exclusive or special applicability to SIP, but instead because it could > have applicability both to SIP and other protocols. Sorry to be repetitious but I do not see that case made, discussed or agreed to in the working group record. What I did see was a repeated claim that using JWT was simpler, which I suspect is quite simply wrong, if only because it requires more mechanism that directly adding the necessary information to a SIP header field. (cf, DKIM, of course.) >> Note that during the wg session in Berlin there was /still/ question >> about where to put the JWT information. > > Kind of. It was a question about the best syntax for transporting only And there's the rub. At this stage of the effort, after 3 years of wg effort, and given three major drafts in wg Last Call, something as basic as how to carry the necessary information for its primary use case is not settled yet. That's quite troubling, both in general and, given the importance and urgency of that motivating use case, in particular. >> The recording of that interim is not accessible and the very terse >> summary text of the session show nothing about an intervention. > > The "intervention" is reflected in the summary text: "Chris Wendt > introduced the verified token being discussed in the IP-NNI task force." Sorry to belabor this but how does 'introducing' something equate to "a major intervention in the work last fall to the effect that we need to build more generically for real-time communications rather than just SIP. We're interested in getting this to work properly with WebRTC..."= ? > We made a decision there to > try to merge these into the core proposal, as the summary reads "An open > design team was formed to discuss finding a common way to address the > signaling." Ahh, so that's what that was intended to mean. Except that while the word 'signaling' does show up in the messages at that time, it doesn't seem to apply to this point. > You are absolutely correct that there were no submissions to the STIR > mailing list immediately following the interim on Friday October 9. Not a > single related email went out on Saturday the 10th, Sunday the 11th, or > even Monday October 12th (which, incidentally, was Columbus Day). Then, o= n > the 13th, the only mail that went out announced that the Doodle poll for > the design team had (behind the scenes) resolved, and that its first > meeting would be that coming Friday, the 16th. The day of that design cal= l > there were 44 messages sent to the list on related subjects. So, I think I understand the general idea behind 'claims' in a larger context of transactions and reputations. As a general model for making and maybe validating a variety of assertions /about/ an entity, it's probably a reasonable approach, although the pragmatics of its application at Internet scale are arguably unproven. However the task of authenticating the proper use of an identifier in a field is a rather more constrained requirement. And there are a number of operational examples, which happen not to require a general claims model= . Simply put, the task is to take an identifier, bind it to the object that is relevant (such as a SIP Invite), where the binding mechanism requires a basic demonstration of 'approval' of the identifier's use, from the authority responsible for administering the identifier. That really is all there is to the required semantics. Things only get complicated when the goal is made more general (which I don't see prompted by the working group charter.) >> Nor do I see anything in the mailing list postings that /do/ show up >> those several days later. > > I can imagine that since I had to annotate even the summary text of the > interim meeting in order to show how it related to this topic, it might > not be clear from the threads on encoding, the NNI and so on how they wer= e > salient to these decisions if you weren't participating in the WG at the > time. Maybe looking at the design team minutes for Oct 16th would be > clearer? It at least mentioned JWT explicitly. I had already looked at those notes. They didn't help. There is nothing I saw that made this expanded scope obvious, nevermind justified. > > https://www.ietf.org/mail-archive/web/stir/current/msg02183.html > >> So I've no idea what you meant by "hard upon it." > > I understand you feel that progress should have been more immediate to > justify my characterization. > >> Hence your explanation: >> >> "we need to build more generically for real-time communications >> rather than just SIP." >> >> does not seem to reflected in the wg record. > > Maybe you'll find the Oct 16th design team minutes clearer on this point. > Or maybe they too would require more annotation to clarify the subject an= d > thinking of the working group after the fact. The discussions that they > reflect, anyway, were sufficient to drive consensus at the time. Sorry. I still don't see any discussion on the list for the specific requirement of other uses. Lots of discussion about delegation -- including one suggesting a lack of requirement for a 'nicely engineered, convoluted, infinitely extensible, handles all corner cases certificate delegation model' -- but not for the expanded scope I am asking after. So perhaps it was agreed to by the group in the same fashion that was apparently going to be expressed for the current draft during the Last Call, namely silence. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir --_000_7594FB04B1934943A5C02806D1A2204B476FE6CBESESSMB209erics_ Content-Type: text/html; charset="windows-1256" Content-Transfer-Encoding: quoted-printable
Hi Dave,

I am the one who originally suggested the usage of JWT. I don't understand = the claim that JWT is "outside the context of SIP". JWT is a gene= ric/standardized mechanism how to calculate and encode a signature, and tha= t is the reason I suggested it - not because I saw usage outside of SIP, or because I wanted to extend the scope of the= charter. I see no reason why JWT can't be used by SIP. If we would NOT use= JWT we would probably have to define more STIR-specific procedures regardi= ng the calculating/encoding of the signature ourselves. It's better to use a standardized mechanism in my opi= nion.

I am also the one who raised the encoding issue in Berlin. But that was not= related to the usage of JWT as such, but to the fact that we don't carry t= he encoded JWT object in one piece in the SIP message. We "split"= the object into two pieces, and carry one piece as the Identity header field value, and the other piece as the canon= header field parameter value. I questioned that, and commented that we, if= we want to do it that way, need more details on how the "split" = is done and how the resulting parts are encoded. Jon promised to add more text to cover those comments. Also note that = ; my comment was not related to draft-passport, but to draft-4474bis.

Regards,

Christer

Sent from my Windows Phone
From: Dave Crocker
Sent: =FD30= /=FD07/=FD2016 02:59
To: Peterson, Jon
Cc: IETF STIR Mail List
Subject: Re: [= stir] Review of: draft-ietf-stir-passport-05

Jon,

On 7/29/2016 2:56 PM, Peterson, Jon wrote:
> The only thing JWT has to do with SIP is that JWT can be a container f= or a
> signed set of metadata and claims that might be useful in preventing > impersonation in a SIP request. JWT was chosen not because it has any<= br> > exclusive or special applicability to SIP, but instead because it coul= d
> have applicability both to SIP and other protocols.

Sorry to be repetitious but I do not see that case made, discussed or
agreed to in the working group record.

What I did see was a repeated claim that using JWT was simpler, which I suspect is quite simply wrong, if only because it requires more
mechanism that directly adding the necessary information to a SIP header field. (cf, DKIM, of course.)


>> Note that during the wg session in Berlin there was /still/ questi= on
>> about where to put the JWT information.
>
> Kind of. It was a question about the best syntax for transporting only=

And there's the rub.  At this stage of the effort, after 3 years of wg=
effort, and given three major drafts in wg Last Call, something as basic as how to carry the necessary information for its primary use case is
not settled yet.  That's quite troubling, both in general and, given t= he
importance and urgency of that motivating use case, in particular.


>> The recording of that interim is not accessible and the very terse=
>> summary text of the session show nothing about an intervention. >
> The "intervention" is reflected in the summary text: "C= hris Wendt
> introduced the verified token being discussed in the IP-NNI task force= ."

Sorry to belabor this but how does 'introducing' something equate to "= a
major intervention in the work last fall to the effect that we
need to build more generically for real-time communications rather than
just SIP. We're interested in getting this to work properly with WebRTC...&= quot;?


>  We made a decision there to
> try to merge these into the core proposal, as the summary reads "= An open
> design team was formed to discuss finding a common way to address the<= br> > signaling."

Ahh, so that's what that was intended to mean.

Except that while the word 'signaling' does show up in the messages at
that time, it doesn't seem to apply to this point.


> You are absolutely correct that there were no submissions to the STIR<= br> > mailing list immediately following the interim on Friday October 9. No= t a
> single related email went out on Saturday the 10th, Sunday the 11th, o= r
> even Monday October 12th (which, incidentally, was Columbus Day). Then= , on
> the 13th, the only mail that went out announced that the Doodle poll f= or
> the design team had (behind the scenes) resolved, and that its first > meeting would be that coming Friday, the 16th. The day of that design = call
> there were 44 messages sent to the list on related subjects.

So, I think I understand the general idea behind 'claims' in a larger
context of transactions and reputations.  As a general model for makin= g
and maybe validating a variety of assertions /about/ an entity, it's
probably a reasonable approach, although the pragmatics of its
application at Internet scale are arguably unproven.

However the task of authenticating the proper use of an identifier in a field is a rather more constrained requirement.  And there are a numbe= r
of operational examples, which happen not to require a general claims model= .

Simply put, the task is to take an identifier, bind it to the object
that is relevant (such as a SIP Invite), where the binding mechanism
requires a basic demonstration of 'approval' of the identifier's use,
from the authority responsible for administering the identifier.  That=
really is all there is to the required semantics.

Things only get complicated when the goal is made more general (which I don't see prompted by the working group charter.)


>> Nor do I see anything in the mailing list postings that /do/ show = up
>> those several days later.
>
> I can imagine that since I had to annotate even the summary text of th= e
> interim meeting in order to show how it related to this topic, it migh= t
> not be clear from the threads on encoding, the NNI and so on how they = were
> salient to these decisions if you weren't participating in the WG at t= he
> time. Maybe looking at the design team minutes for Oct 16th would be > clearer? It at least mentioned JWT explicitly.

I had already looked at those notes.  They didn't help.  There is=
nothing I saw that made this expanded scope obvious, nevermind justified.
>
> https://www.ietf.org/mail-archive/web/stir/current/msg02183.html=
>
>> So I've no idea what you meant by "hard upon it."
>
> I understand you feel that progress should have been more immediate to=
> justify my characterization.
>
>> Hence your explanation:
>>
>>      "we need to build more generica= lly for real-time communications
>> rather than just SIP."
>>
>> does not seem to reflected in the wg record.
>
> Maybe you'll find the Oct 16th design team minutes clearer on this poi= nt.
> Or maybe they too would require more annotation to clarify the subject= and
> thinking of the working group after the fact. The discussions that the= y
> reflect, anyway, were sufficient to drive consensus at the time.

Sorry.  I still don't see any discussion on the list for the specific =
requirement of other uses.  Lots of discussion about delegation -- including one suggesting a lack of requirement for a 'nicely engineered, convoluted, infinitely extensible, handles all corner cases certificate delegation model' -- but not for the expanded scope I am asking after.

So perhaps it was agreed to by the group in the same fashion that was
apparently going to be expressed for the current draft during the Last
Call, namely silence.

d/

--

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net

_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org= /mailman/listinfo/stir
 --_000_7594FB04B1934943A5C02806D1A2204B476FE6CBESESSMB209erics_-- From nobody Sat Jul 30 06:04:10 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D1BD512D137 for ; Sat, 30 Jul 2016 06:04:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.107 X-Spam-Level: X-Spam-Status: No, score=-1.107 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RDNS_NONE=0.793] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2odb2SuWUdDW for ; Sat, 30 Jul 2016 06:04:09 -0700 (PDT) Received: from simon.songbird.com (unknown [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4DC7512B029 for ; Sat, 30 Jul 2016 06:04:09 -0700 (PDT) Received: from [192.168.1.168] (76-218-8-128.lightspeed.sntcca.sbcglobal.net [76.218.8.128]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id u6UD4omh003232 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Sat, 30 Jul 2016 06:04:51 -0700 To: Christer Holmberg , "Peterson, Jon" References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B476FE6CB@ESESSMB209.ericsson.se> From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <7f35b810-0eca-5140-060e-4aef03449c21@dcrocker.net> Date: Sat, 30 Jul 2016 06:03:56 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <7594FB04B1934943A5C02806D1A2204B476FE6CB@ESESSMB209.ericsson.se> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: IETF STIR Mail List Subject: Re: [stir] Review of: draft-ietf-stir-passport-05 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 30 Jul 2016 13:04:10 -0000 Christer, Thanks for the background... On 7/30/2016 4:30 AM, Christer Holmberg wrote: > I am the one who originally suggested the usage of JWT. I don't > understand the claim that JWT is "outside the context of SIP". JWT is a > generic/standardized mechanism how to calculate and encode a signature, Actually, it isn't. It's own opening text [RFC 7519] says it is "a compact, URL-safe means of representing claims to be transferred between two parties" but more importantly for this issue, it goes on to say: "encoded as a JSON object that is used as the payload of a JSON Web Signature (JWS) structure or as the plaintext of a JSON Web Encryption (JWE) structure" That is, it provides value-added functions... to a JSON object (structure). However SIP doesn't have a JSON object to sign. So the working group has had to invent a JSON-based abstraction of SIP header information and then sign it. Now it has to invent an encoding for the resulting signature. It would have to do that for a SIP call, no matter the signature's computational abstraction, but because that abstraction is actually an independent format, it wound up distracting the wg from doing a complete job -- so far, after 3 years -- of defining all the details for a complete authentication mechanism. From what I can tell of the email record for the wg, the unfortunate part of the discussion about choices here was to count JSON/JWT as something other than an abstraction. Signing an object requires defining the data over which the signature will be made, and how that data will be fed into the signing algorithm. Necessarily, that defines an abstraction of the data. (Canonicalization seems to be a common component of that abstraction, for example.) There might be nothing different or better (or, probably, worse) about JWT in those terms; I haven't tried to evaluate it in those terms. The problem is that its existence as a distinct format has caused the working group to worry about that new and independent object as distinct from the SIP data being signed, rather than as a computational result that then needs to be stored into the SIP header. So all of the discussion about what to do with the JWT object is additional wg overhead and, IMO, a complete distraction for the primary task of the working group. (My guess is that there is also added overall system complexity, but I won't press that concern, at this point.) Arguments that it's a general mechanism for use in other aspects of this space are always appealing. However they are, so far, without merit in the working group context: There are no specifications for any of those other uses. And the wg still hasn't resolved the very basic and very essential step of putting the signature into the SIP header. > If we would NOT use JWT we would > probably have to define more STIR-specific procedures regarding the > calculating/encoding of the signature ourselves. It's better to use a > standardized mechanism in my opinion. Well, yeah, I thought/think that too, which was why I originally suggested adapting DKIM. (DANE might be another relevant choice.) DKIM offers an extremely high point of departure for SIP header signing. The continued lack of complete specification details about use with SIP demonstrates that JWT doesn't. > I am also the one who raised the encoding issue in Berlin. But that was > not related to the usage of JWT as such, but to the fact that we don't > carry the encoded JWT object in one piece in the SIP message. We "split" > the object into two pieces, and carry one piece as the Identity header > field value, and the other piece as the canon header field parameter > value. Right. And the point I'm raising is not about the details of that choice but the fact that it still hasn't been made at this very late stage. Besides merely being a missing, essential bit of system specification, it suggests that the wg is still not completely clear about the concrete use of this capability. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Sat Jul 30 14:08:43 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 22AF912B058 for ; Sat, 30 Jul 2016 14:08:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=chriswendt-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 27Qk2ROXUD0k for ; Sat, 30 Jul 2016 14:08:40 -0700 (PDT) Received: from mail-qk0-x22f.google.com (mail-qk0-x22f.google.com [IPv6:2607:f8b0:400d:c09::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 474FB126D74 for ; Sat, 30 Jul 2016 14:08:40 -0700 (PDT) Received: by mail-qk0-x22f.google.com with SMTP id o67so117384878qke.1 for ; Sat, 30 Jul 2016 14:08:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chriswendt-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=04/st//ex4oJMq4GRnjENkjWN99S+oFjqJY67CN3Vgc=; b=YpguN0hsf9UN1AktEqHffNtPSovpvEkKmcof+DXE5mrjlp0tnNANf01MzJvxvFq3y/ YbYhUgcL8N0Or6bPxmyrj7WtmKCr5HyKjpzROykvYsqj0QCagn9vYE996sc1a4JY09f0 IuD6xqNazEZTyK/WBbSilRTwSMCZcBvfzTM4xmr4IBf7lKaMy0M06NKzB/MsUCMDNMA/ FT7l9A4e66evHG5fax8svKFerStlB07FBLBLnBphRPljROm9VvFPxnHr4SdBRQoWOycc j98Z8YkLfAxzUYkfd0a0qp+kC6r72EAvX+xMBDmi/1bgpda8pOKiaS3r8M14TWaYokHF 7BlQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=04/st//ex4oJMq4GRnjENkjWN99S+oFjqJY67CN3Vgc=; b=eopi6RuEmmc0pPyl2OOzUhzU8ZdiKa6nkDa5IsHF1nQ/U+wEfPx8cqchroHaiMKiJf Mv3sdla2rgGahvQK/VGwQ2MAvRBuxJrkmOZjUnYehVlK1pTRyq3fhGrWTLeMsRL9qySp tZX046hQGkLlJLD9IN/Xl7oAIarl7I/XjwoxWK80X2VnZGpegXCRVCcKZy6iBYL0Xfrf qMkwAhO7TydHrWOExfq4pJIg+3i6GauAz53gikDVtf1o2D2Gm6J/fW3cIOkB9fQwUWwU 4PBlyrzoQHRANNk/Ilk5959ChAqaD4uCbQW3c7OwBD/tIxZiFjUi9DnISzY670qyGPKQ nc9w== X-Gm-Message-State: AEkoousJoItbbSfnrUfxS3on5I1ZjBcYEKJbfMMDQILWOCvn7nHpu9q++zHxElv1BHJLAw== X-Received: by 10.55.39.205 with SMTP id n196mr12557791qkn.149.1469912919123; Sat, 30 Jul 2016 14:08:39 -0700 (PDT) Received: from [172.20.20.20] ([73.112.13.8]) by smtp.gmail.com with ESMTPSA id z32sm13446603qtz.0.2016.07.30.14.08.38 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sat, 30 Jul 2016 14:08:38 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Chris Wendt In-Reply-To: <7f35b810-0eca-5140-060e-4aef03449c21@dcrocker.net> Date: Sat, 30 Jul 2016 17:08:41 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B476FE6CB@ESESSMB209.ericsson.se> <7f35b810-0eca-5140-060e-4aef03449c21@dcrocker.net> To: dcrocker@bbiw.net X-Mailer: Apple Mail (2.3124) Archived-At: Cc: IETF STIR Mail List , "Peterson, Jon" , Christer Holmberg Subject: Re: [stir] Review of: draft-ietf-stir-passport-05 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 30 Jul 2016 21:08:42 -0000 Hi Dave, I=E2=80=99m not following your argument that because there isn=E2=80=99t = a JSON object to sign, we can=E2=80=99t use JWT? In general, most/all uses of JWT don=E2=80=99t sign an existing object, = a set of claims are constructed into a JSON payload that is signed. There are JWT defined claims precisely defined to create a secure token = intentionally meant to be only signed in a JWT. So to me, we are more than appropriately using JSON and JWT. It is in 4474bis, we define the exact information to construct the JSON = payload object to be signed, so please refer to that. There are many advantages to using the JWT construct both for STIR = charter specifically and elsewhere. Is that a bad thing? -Chris > On Jul 30, 2016, at 9:03 AM, Dave Crocker wrote: >=20 > Christer, >=20 > Thanks for the background... >=20 > On 7/30/2016 4:30 AM, Christer Holmberg wrote: >> I am the one who originally suggested the usage of JWT. I don't >> understand the claim that JWT is "outside the context of SIP". JWT is = a >> generic/standardized mechanism how to calculate and encode a = signature, >=20 > Actually, it isn't. >=20 > It's own opening text [RFC 7519] says it is "a compact, URL-safe means = of representing claims to be transferred between two parties" but more = importantly for this issue, it goes on to say: >=20 > "encoded as a JSON object that is used as the payload of a JSON > Web Signature (JWS) structure or as the plaintext of a JSON Web > Encryption (JWE) structure" >=20 > That is, it provides value-added functions... to a JSON object = (structure). However SIP doesn't have a JSON object to sign. So the = working group has had to invent a JSON-based abstraction of SIP header = information and then sign it. >=20 > Now it has to invent an encoding for the resulting signature. It = would have to do that for a SIP call, no matter the signature's = computational abstraction, but because that abstraction is actually an = independent format, it wound up distracting the wg from doing a complete = job -- so far, after 3 years -- of defining all the details for a = complete authentication mechanism. >=20 > =46rom what I can tell of the email record for the wg, the unfortunate = part of the discussion about choices here was to count JSON/JWT as = something other than an abstraction. >=20 > Signing an object requires defining the data over which the signature = will be made, and how that data will be fed into the signing algorithm. = Necessarily, that defines an abstraction of the data. (Canonicalization = seems to be a common component of that abstraction, for example.) >=20 > There might be nothing different or better (or, probably, worse) about = JWT in those terms; I haven't tried to evaluate it in those terms. The = problem is that its existence as a distinct format has caused the = working group to worry about that new and independent object as distinct = from the SIP data being signed, rather than as a computational result = that then needs to be stored into the SIP header. So all of the = discussion about what to do with the JWT object is additional wg = overhead and, IMO, a complete distraction for the primary task of the = working group. (My guess is that there is also added overall system = complexity, but I won't press that concern, at this point.) >=20 > Arguments that it's a general mechanism for use in other aspects of = this space are always appealing. However they are, so far, without merit = in the working group context: There are no specifications for any of = those other uses. >=20 > And the wg still hasn't resolved the very basic and very essential = step of putting the signature into the SIP header. >=20 >=20 >=20 >> If we would NOT use JWT we would >> probably have to define more STIR-specific procedures regarding the >> calculating/encoding of the signature ourselves. It's better to use a >> standardized mechanism in my opinion. >=20 > Well, yeah, I thought/think that too, which was why I originally = suggested adapting DKIM. (DANE might be another relevant choice.) DKIM = offers an extremely high point of departure for SIP header signing. The = continued lack of complete specification details about use with SIP = demonstrates that JWT doesn't. >=20 >=20 >> I am also the one who raised the encoding issue in Berlin. But that = was >> not related to the usage of JWT as such, but to the fact that we = don't >> carry the encoded JWT object in one piece in the SIP message. We = "split" >> the object into two pieces, and carry one piece as the Identity = header >> field value, and the other piece as the canon header field parameter >> value. >=20 > Right. And the point I'm raising is not about the details of that = choice but the fact that it still hasn't been made at this very late = stage. >=20 > Besides merely being a missing, essential bit of system specification, = it suggests that the wg is still not completely clear about the concrete = use of this capability. >=20 >=20 > d/ > --=20 >=20 > Dave Crocker > Brandenburg InternetWorking > bbiw.net >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir From nobody Sun Jul 31 10:54:10 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E880212D50E for ; Sun, 31 Jul 2016 10:54:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.22 X-Spam-Level: X-Spam-Status: No, score=-4.22 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 10sYk8oT9-1N for ; Sun, 31 Jul 2016 10:54:06 -0700 (PDT) Received: from sessmg23.ericsson.net (sessmg23.ericsson.net [193.180.251.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D70B812B009 for ; Sun, 31 Jul 2016 10:54:05 -0700 (PDT) X-AuditID: c1b4fb2d-bbfff70000000190-66-579e3b3962bb Received: from ESESSHC008.ericsson.se (Unknown_Domain [153.88.183.42]) by (Symantec Mail Security) with SMTP id 0C.43.00400.93B3E975; Sun, 31 Jul 2016 19:54:03 +0200 (CEST) Received: from ESESSMB209.ericsson.se ([169.254.9.142]) by ESESSHC008.ericsson.se ([153.88.183.42]) with mapi id 14.03.0301.000; Sun, 31 Jul 2016 19:54:00 +0200 From: Christer Holmberg To: Chris Wendt , "dcrocker@bbiw.net" Thread-Topic: [stir] Review of: draft-ietf-stir-passport-05 Thread-Index: AQHR6Pa8IhcNFBWCX0CjWpL6ATcrHqAvhU6AgAAES4CAAAVOAIAAOSgAgAAMsQCAACJJAIAA4os4///4oACAAIdwgIABfXdE Date: Sun, 31 Jul 2016 17:54:00 +0000 Message-ID: <7594FB04B1934943A5C02806D1A2204B477074D5@ESESSMB209.ericsson.se> References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B476FE6CB@ESESSMB209.ericsson.se> <7f35b810-0eca-5140-060e-4aef03449c21@dcrocker.net>, In-Reply-To: Accept-Language: en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: multipart/alternative; boundary="_000_7594FB04B1934943A5C02806D1A2204B477074D5ESESSMB209erics_" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprOIsWRmVeSWpSXmKPExsUyM2K7lq619bxwgxVPDSymf9rNbPH70wc2 izMNlhbL125jcmDxuLTzJJvHhL41rB5Llvxk8tjR8Jw5gCWKyyYlNSezLLVI3y6BK+Pd7cuM BZOKK3o//WVpYPwa18XIwSEhYCLx6YlAFyMXh5DAekaJ/8+vMUE4SxglHt79xwxSxCZgIdH9 T7uLkZNDRCBM4sjzpywgNrNAqMTXF8vAbGEBK4m9q46xgZSLCFhL3J8pCVGeJzHpz2p2kDCL gKrEydkRICavgK9Exy1TiEUzWCRmTZ0BVsIp4CTxol0RpJNRQEzi+6k1TBCLxCWavqxkBbEl BAQkluw5zwxhi0q8fPyPFaImX2Lzidtg9bwCghInZz5hmcAoPAtJ+ywkZbOQlEHEDSS+vL8N ZWtLLFv4mhnC1pfofn+aCVl8ASP7KkbR4tTi4tx0I2O91KLM5OLi/Dy9vNSSTYzA6Dq45bfu DsbVrx0PMQpwMCrx8CawzAsXYk0sK67MPcQowcGsJMLLow8U4k1JrKxKLcqPLyrNSS0+xCjN waIkzuv/UjFcSCA9sSQ1OzW1ILUIJsvEwSnVwFjdJV24PPrwFbMjMwq4MhMiHI6sPZNhuVpN +8paxgk9XY4Kt4p6l7szvTr27eC6plrn+yHtNkarP8fv//7eOejn5OLt84rTtedOZP55bqVJ 6M6vmeURpq0zPCKKztc1HBC95i3hvfMf3077N2e28l6UDOE/erPl/cQEkcUsrAquUgyVgfo8 MkosxRmJhlrMRcWJAFmtWweqAgAA Archived-At: Cc: IETF STIR Mail List , "Peterson, Jon" Subject: Re: [stir] Review of: draft-ietf-stir-passport-05 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 31 Jul 2016 17:54:09 -0000 --_000_7594FB04B1934943A5C02806D1A2204B477074D5ESESSMB209erics_ Content-Type: text/plain; charset="windows-1256" Content-Transfer-Encoding: quoted-printable Hi, I agree with Chris. JWT is NOT a mechanism to sign any arbitrary JSON struc= ture. JWT is a mechanism to sign data, and it uses a specific JSON structur= e (header, claims etc) for doing so. In addition, it provides a mechanism t= o signal what data/algorithm is used to calculate the signature. Regards, Christer Sent from my Windows Phone ________________________________ From: Chris Wendt Sent: =FD31/=FD07/=FD2016 00:08 To: dcrocker@bbiw.net Cc: Christer Holmberg; Peterson, Jon= ; IETF STIR Mail List Subject: Re: [stir] Review of: draft-ietf-stir-passport-05 Hi Dave, I=92m not following your argument that because there isn=92t a JSON object = to sign, we can=92t use JWT? In general, most/all uses of JWT don=92t sign an existing object, a set of = claims are constructed into a JSON payload that is signed. There are JWT defined claims precisely defined to create a secure token int= entionally meant to be only signed in a JWT. So to me, we are more than appropriately using JSON and JWT. It is in 4474bis, we define the exact information to construct the JSON pay= load object to be signed, so please refer to that. There are many advantages to using the JWT construct both for STIR charter = specifically and elsewhere. Is that a bad thing? -Chris > On Jul 30, 2016, at 9:03 AM, Dave Crocker wrote: > > Christer, > > Thanks for the background... > > On 7/30/2016 4:30 AM, Christer Holmberg wrote: >> I am the one who originally suggested the usage of JWT. I don't >> understand the claim that JWT is "outside the context of SIP". JWT is a >> generic/standardized mechanism how to calculate and encode a signature, > > Actually, it isn't. > > It's own opening text [RFC 7519] says it is "a compact, URL-safe means of= representing claims to be transferred between two parties" but more import= antly for this issue, it goes on to say: > > "encoded as a JSON object that is used as the payload of a JSON > Web Signature (JWS) structure or as the plaintext of a JSON Web > Encryption (JWE) structure" > > That is, it provides value-added functions... to a JSON object (structure= ). However SIP doesn't have a JSON object to sign. So the working group h= as had to invent a JSON-based abstraction of SIP header information and the= n sign it. > > Now it has to invent an encoding for the resulting signature. It would h= ave to do that for a SIP call, no matter the signature's computational abst= raction, but because that abstraction is actually an independent format, it= wound up distracting the wg from doing a complete job -- so far, after 3 y= ears -- of defining all the details for a complete authentication mechanism= . > > From what I can tell of the email record for the wg, the unfortunate part= of the discussion about choices here was to count JSON/JWT as something ot= her than an abstraction. > > Signing an object requires defining the data over which the signature wil= l be made, and how that data will be fed into the signing algorithm. Necess= arily, that defines an abstraction of the data. (Canonicalization seems to= be a common component of that abstraction, for example.) > > There might be nothing different or better (or, probably, worse) about JW= T in those terms; I haven't tried to evaluate it in those terms. The probl= em is that its existence as a distinct format has caused the working group = to worry about that new and independent object as distinct from the SIP dat= a being signed, rather than as a computational result that then needs to be= stored into the SIP header. So all of the discussion about what to do wit= h the JWT object is additional wg overhead and, IMO, a complete distraction= for the primary task of the working group. (My guess is that there is als= o added overall system complexity, but I won't press that concern, at this = point.) > > Arguments that it's a general mechanism for use in other aspects of this = space are always appealing. However they are, so far, without merit in the = working group context: There are no specifications for any of those other u= ses. > > And the wg still hasn't resolved the very basic and very essential step o= f putting the signature into the SIP header. > > > >> If we would NOT use JWT we would >> probably have to define more STIR-specific procedures regarding the >> calculating/encoding of the signature ourselves. It's better to use a >> standardized mechanism in my opinion. > > Well, yeah, I thought/think that too, which was why I originally suggeste= d adapting DKIM. (DANE might be another relevant choice.) DKIM offers an e= xtremely high point of departure for SIP header signing. The continued lac= k of complete specification details about use with SIP demonstrates that JW= T doesn't. > > >> I am also the one who raised the encoding issue in Berlin. But that was >> not related to the usage of JWT as such, but to the fact that we don't >> carry the encoded JWT object in one piece in the SIP message. We "split" >> the object into two pieces, and carry one piece as the Identity header >> field value, and the other piece as the canon header field parameter >> value. > > Right. And the point I'm raising is not about the details of that choice= but the fact that it still hasn't been made at this very late stage. > > Besides merely being a missing, essential bit of system specification, it= suggests that the wg is still not completely clear about the concrete use = of this capability. > > > d/ > -- > > Dave Crocker > Brandenburg InternetWorking > bbiw.net > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir --_000_7594FB04B1934943A5C02806D1A2204B477074D5ESESSMB209erics_ Content-Type: text/html; charset="windows-1256" Content-Transfer-Encoding: quoted-printable
Hi,

I agree with Chris. JWT is NOT a mechanism to sign any arbitrary JSON struc= ture. JWT is a mechanism to sign data, and it uses a specific JSON structur= e (header, claims etc) for doing so. In addition, it provides a mechanism t= o signal what data/algorithm is used to calculate the signature.

Regards,

Christer

Sent from my Windows Phone
From: Chris Wendt
Sent: =FD31= /=FD07/=FD2016 00:08
To: dcrocker@bbiw.net
Cc: Christer Holmberg; Peterson, Jon; IETF STIR Mail List
Subject: Re: [= stir] Review of: draft-ietf-stir-passport-05

Hi Dave,

I=92m not following your argument that because there isn=92t a JSON object = to sign, we can=92t use JWT?
In general, most/all uses of JWT don=92t sign an existing object, a set of = claims are constructed into a JSON payload that is signed.
There are JWT defined claims precisely defined to create a secure token int= entionally meant to be only signed in a JWT.

So to me, we are more than appropriately using JSON and JWT.

It is in 4474bis, we define the exact information to construct the JSON pay= load object to be signed, so please refer to that.

There are many advantages to using the JWT construct both for STIR charter = specifically and elsewhere.

Is that a bad thing?

-Chris

> On Jul 30, 2016, at 9:03 AM, Dave Crocker <dhc@dcrocker.net> wro= te:
>
> Christer,
>
> Thanks for the background...
>
> On 7/30/2016 4:30 AM, Christer Holmberg wrote:
>> I am the one who originally suggested the usage of JWT. I don't >> understand the claim that JWT is "outside the context of SIP&= quot;. JWT is a
>> generic/standardized mechanism how to calculate and encode a signa= ture,
>
> Actually, it isn't.
>
> It's own opening text [RFC 7519] says it is "a compact, URL-safe = means of representing claims to be transferred between two parties" bu= t more importantly for this issue, it goes on to say:
>
>   "encoded as a JSON object that is used as the payload= of a JSON
>   Web Signature (JWS) structure or as the plaintext of a JSO= N Web
>   Encryption (JWE) structure"
>
> That is, it provides value-added functions... to a JSON object (struct= ure).  However SIP doesn't have a JSON object to sign.  So the wo= rking group has had to invent a JSON-based abstraction of SIP header inform= ation and then sign it.
>
> Now it has to invent an encoding for the resulting signature.  It= would have to do that for a SIP call, no matter the signature's computatio= nal abstraction, but because that abstraction is actually an independent fo= rmat, it wound up distracting the wg from doing a complete job -- so far, after 3 years -- of defining all the detai= ls for a complete authentication mechanism.
>
> From what I can tell of the email record for the wg, the unfortunate p= art of the discussion about choices here was to count JSON/JWT as something= other than an abstraction.
>
> Signing an object requires defining the data over which the signature = will be made, and how that data will be fed into the signing algorithm. Nec= essarily, that defines an abstraction of the data.  (Canonicalization = seems to be a common component of that abstraction, for example.)
>
> There might be nothing different or better (or, probably, worse) about= JWT in those terms; I haven't tried to evaluate it in those terms.  T= he problem is that its existence as a distinct format has caused the workin= g group to worry about that new and independent object as distinct from the SIP data being signed, rather than as a comput= ational result that then needs to be stored into the SIP header.  So a= ll of the discussion about what to do with the JWT object is additional wg = overhead and, IMO, a complete distraction for the primary task of the working group.  (My guess is that there i= s also added overall system complexity, but I won't press that concern, at = this point.)
>
> Arguments that it's a general mechanism for use in other aspects of th= is space are always appealing. However they are, so far, without merit in t= he working group context: There are no specifications for any of those othe= r uses.
>
> And the wg still hasn't resolved the very basic and very essential ste= p of putting the signature into the SIP header.
>
>
>
>>     If we would NOT use JWT we would
>> probably have to define more STIR-specific procedures regarding th= e
>> calculating/encoding of the signature ourselves. It's better to us= e a
>> standardized mechanism in my opinion.
>
> Well, yeah, I thought/think that too, which was why I originally sugge= sted adapting DKIM. (DANE might be another relevant choice.)  DKIM off= ers an extremely high point of departure for SIP header signing.  The = continued lack of complete specification details about use with SIP demonstrates that JWT doesn't.
>
>
>> I am also the one who raised the encoding issue in Berlin. But tha= t was
>> not related to the usage of JWT as such, but to the fact that we d= on't
>> carry the encoded JWT object in one piece in the SIP message. We &= quot;split"
>> the object into two pieces, and carry one piece as the Identity he= ader
>> field value, and the other piece as the canon header field paramet= er
>> value.
>
> Right.  And the point I'm raising is not about the details of tha= t choice but the fact that it still hasn't been made at this very late stag= e.
>
> Besides merely being a missing, essential bit of system specification,= it suggests that the wg is still not completely clear about the concrete u= se of this capability.
>
>
> d/
> --
>
>  Dave Crocker
>  Brandenburg InternetWorking
>  bbiw.net
>
> _______________________________________________
> stir mailing list
> stir@ietf.org
> https://www.iet= f.org/mailman/listinfo/stir

 --_000_7594FB04B1934943A5C02806D1A2204B477074D5ESESSMB209erics_-- From nobody Sun Jul 31 11:44:56 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 23BE912B03F for ; Sun, 31 Jul 2016 11:44:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.506 X-Spam-Level: X-Spam-Status: No, score=-5.506 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-1.287, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z1j0CaPXoql9 for ; Sun, 31 Jul 2016 11:44:53 -0700 (PDT) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 117EB12B011 for ; Sun, 31 Jul 2016 11:44:53 -0700 (PDT) Received: from aserv0021.oracle.com (aserv0021.oracle.com [141.146.126.233]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id u6VIicMD018795 (version=TLSv1 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Sun, 31 Jul 2016 18:44:38 GMT Received: from userv0121.oracle.com (userv0121.oracle.com [156.151.31.72]) by aserv0021.oracle.com (8.13.8/8.13.8) with ESMTP id u6VIib5f019599 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Sun, 31 Jul 2016 18:44:38 GMT Received: from abhmp0002.oracle.com (abhmp0002.oracle.com [141.146.116.8]) by userv0121.oracle.com (8.13.8/8.13.8) with ESMTP id u6VIiZ2A032582; Sun, 31 Jul 2016 18:44:36 GMT Received: from [192.168.1.34] (/83.32.133.0) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Sun, 31 Jul 2016 11:44:34 -0700 References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B476FE6CB@ESESSMB209.ericsson.se> <7f35b810-0eca-5140-060e-4aef03449c21@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B477074D5@ESESSMB209.ericsson.se> Mime-Version: 1.0 (1.0) In-Reply-To: <7594FB04B1934943A5C02806D1A2204B477074D5@ESESSMB209.ericsson.se> Content-Type: multipart/alternative; boundary=Apple-Mail-8975C242-323F-43B1-AF11-A01F428AFD57 Content-Transfer-Encoding: 7bit Message-Id: X-Mailer: iPhone Mail (12D508) From: Victor Pascual Date: Sun, 31 Jul 2016 20:44:30 +0200 To: Christer Holmberg X-Source-IP: aserv0021.oracle.com [141.146.126.233] Archived-At: Cc: Chris Wendt , "dcrocker@bbiw.net" , "Peterson, Jon" , IETF STIR Mail List Subject: Re: [stir] Review of: draft-ietf-stir-passport-05 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 31 Jul 2016 18:44:55 -0000 --Apple-Mail-8975C242-323F-43B1-AF11-A01F428AFD57 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Fully agree > On 31 Jul 2016, at 19:54, Christer Holmberg wrote: >=20 > Hi, >=20 > I agree with Chris. JWT is NOT a mechanism to sign any arbitrary JSON stru= cture. JWT is a mechanism to sign data, and it uses a specific JSON structur= e (header, claims etc) for doing so. In addition, it provides a mechanism to= signal what data/algorithm is used to calculate the signature. >=20 > Regards, >=20 > Christer >=20 > Sent from my Windows Phone > From: Chris Wendt > Sent: =E2=80=8E31/=E2=80=8E07/=E2=80=8E2016 00:08 > To: dcrocker@bbiw.net > Cc: Christer Holmberg; Peterson, Jon; IETF STIR Mail List > Subject: Re: [stir] Review of: draft-ietf-stir-passport-05 >=20 > Hi Dave, >=20 > I=E2=80=99m not following your argument that because there isn=E2=80=99t a= JSON object to sign, we can=E2=80=99t use JWT? > In general, most/all uses of JWT don=E2=80=99t sign an existing object, a s= et of claims are constructed into a JSON payload that is signed. > There are JWT defined claims precisely defined to create a secure token in= tentionally meant to be only signed in a JWT. >=20 > So to me, we are more than appropriately using JSON and JWT. >=20 > It is in 4474bis, we define the exact information to construct the JSON pa= yload object to be signed, so please refer to that. >=20 > There are many advantages to using the JWT construct both for STIR charter= specifically and elsewhere. >=20 > Is that a bad thing? >=20 > -Chris >=20 > > On Jul 30, 2016, at 9:03 AM, Dave Crocker wrote: > >=20 > > Christer, > >=20 > > Thanks for the background... > >=20 > > On 7/30/2016 4:30 AM, Christer Holmberg wrote: > >> I am the one who originally suggested the usage of JWT. I don't > >> understand the claim that JWT is "outside the context of SIP". JWT is a= > >> generic/standardized mechanism how to calculate and encode a signature,= > >=20 > > Actually, it isn't. > >=20 > > It's own opening text [RFC 7519] says it is "a compact, URL-safe means o= f representing claims to be transferred between two parties" but more import= antly for this issue, it goes on to say: > >=20 > > "encoded as a JSON object that is used as the payload of a JSON > > Web Signature (JWS) structure or as the plaintext of a JSON Web > > Encryption (JWE) structure" > >=20 > > That is, it provides value-added functions... to a JSON object (structur= e). However SIP doesn't have a JSON object to sign. So the working group h= as had to invent a JSON-based abstraction of SIP header information and then= sign it. > >=20 > > Now it has to invent an encoding for the resulting signature. It would h= ave to do that for a SIP call, no matter the signature's computational abstr= action, but because that abstraction is actually an independent format, it w= ound up distracting the wg from doing a complete job -- so far, after 3 year= s -- of defining all the details for a complete authentication mechanism. > >=20 > > =46rom what I can tell of the email record for the wg, the unfortunate p= art of the discussion about choices here was to count JSON/JWT as something o= ther than an abstraction. > >=20 > > Signing an object requires defining the data over which the signature wi= ll be made, and how that data will be fed into the signing algorithm. Necess= arily, that defines an abstraction of the data. (Canonicalization seems to b= e a common component of that abstraction, for example.) > >=20 > > There might be nothing different or better (or, probably, worse) about J= WT in those terms; I haven't tried to evaluate it in those terms. The probl= em is that its existence as a distinct format has caused the working group t= o worry about that new and independent object as distinct from the SIP data b= eing signed, rather than as a computational result that then needs to be sto= red into the SIP header. So all of the discussion about what to do with the= JWT object is additional wg overhead and, IMO, a complete distraction for t= he primary task of the working group. (My guess is that there is also added= overall system complexity, but I won't press that concern, at this point.) > >=20 > > Arguments that it's a general mechanism for use in other aspects of this= space are always appealing. However they are, so far, without merit in the w= orking group context: There are no specifications for any of those other use= s. > >=20 > > And the wg still hasn't resolved the very basic and very essential step o= f putting the signature into the SIP header. > >=20 > >=20 > >=20 > >> If we would NOT use JWT we would > >> probably have to define more STIR-specific procedures regarding the > >> calculating/encoding of the signature ourselves. It's better to use a > >> standardized mechanism in my opinion. > >=20 > > Well, yeah, I thought/think that too, which was why I originally suggest= ed adapting DKIM. (DANE might be another relevant choice.) DKIM offers an e= xtremely high point of departure for SIP header signing. The continued lack= of complete specification details about use with SIP demonstrates that JWT d= oesn't. > >=20 > >=20 > >> I am also the one who raised the encoding issue in Berlin. But that was= > >> not related to the usage of JWT as such, but to the fact that we don't > >> carry the encoded JWT object in one piece in the SIP message. We "split= " > >> the object into two pieces, and carry one piece as the Identity header > >> field value, and the other piece as the canon header field parameter > >> value. > >=20 > > Right. And the point I'm raising is not about the details of that choic= e but the fact that it still hasn't been made at this very late stage. > >=20 > > Besides merely being a missing, essential bit of system specification, i= t suggests that the wg is still not completely clear about the concrete use o= f this capability. > >=20 > >=20 > > d/ > > --=20 > >=20 > > Dave Crocker > > Brandenburg InternetWorking > > bbiw.net > >=20 > > _______________________________________________ > > stir mailing list > > stir@ietf.org > > https://www.ietf.org/mailman/listinfo/stir >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir --Apple-Mail-8975C242-323F-43B1-AF11-A01F428AFD57 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
Fully agree

On 31 Ju= l 2016, at 19:54, Christer Holmberg <christer.holmberg@ericsson.com> wrote:

Hi,

I agree with Chris. JWT is NOT a mechanism to sign any arbitrary JSON struct= ure. JWT is a mechanism to sign data, and it uses a specific JSON structure (= header, claims etc) for doing so. In addition, it provides a mechanism to si= gnal what data/algorithm is used to calculate the signature.

Regards,

Christer

Sent from my Windows Phone
From: Chris Wendt
Sent: =E2=80= =8E31/=E2=80=8E07/=E2=80=8E2016 00:08
To: dcrocker@bbiw.net
Cc: Christer Holmberg; Peterson, Jon; IETF STIR Mail List
Subject: Re: [s= tir] Review of: draft-ietf-stir-passport-05

Hi Dave,

I=E2=80=99m not following your argument that because there isn=E2=80=99t a J= SON object to sign, we can=E2=80=99t use JWT?
In general, most/all uses of JWT don=E2=80=99t sign an existing object, a se= t of claims are constructed into a JSON payload that is signed.
There are JWT defined claims precisely defined to create a secure token inte= ntionally meant to be only signed in a JWT.

So to me, we are more than appropriately using JSON and JWT.

It is in 4474bis, we define the exact information to construct the JSON payl= oad object to be signed, so please refer to that.

There are many advantages to using the JWT construct both for STIR charter s= pecifically and elsewhere.

Is that a bad thing?

-Chris

> On Jul 30, 2016, at 9:03 AM, Dave Crocker <dhc@dcrocker.net> wrote:
>
> Christer,
>
> Thanks for the background...
>
> On 7/30/2016 4:30 AM, Christer Holmberg wrote:
>> I am the one who originally suggested the usage of JWT. I don't
= >> understand the claim that JWT is "outside the context of SIP". JWT i= s a
>> generic/standardized mechanism how to calculate and encode a signat= ure,
>
> Actually, it isn't.
>
> It's own opening text [RFC 7519] says it is "a compact, URL-safe means o= f representing claims to be transferred between two parties" but more import= antly for this issue, it goes on to say:
>
>   "encoded as a JSON object that is used as the payload of a J= SON
>   Web Signature (JWS) structure or as the plaintext of a JSON= Web
>   Encryption (JWE) structure"
>
> That is, it provides value-added functions... to a JSON object (structu= re).  However SIP doesn't have a JSON object to sign.  So the work= ing group has had to invent a JSON-based abstraction of SIP header informati= on and then sign it.
>
> Now it has to invent an encoding for the resulting signature.  It w= ould have to do that for a SIP call, no matter the signature's computational= abstraction, but because that abstraction is actually an independent format= , it wound up distracting the wg from doing a complete job -- so far, after 3 years -- of defining all the detail= s for a complete authentication mechanism.
>
> =46rom what I can tell of the email record for the wg, the unfortunate p= art of the discussion about choices here was to count JSON/JWT as something o= ther than an abstraction.
>
> Signing an object requires defining the data over which the signature w= ill be made, and how that data will be fed into the signing algorithm. Neces= sarily, that defines an abstraction of the data.  (Canonicalization see= ms to be a common component of that abstraction, for example.)
>
> There might be nothing different or better (or, probably, worse) about J= WT in those terms; I haven't tried to evaluate it in those terms.  The p= roblem is that its existence as a distinct format has caused the working gro= up to worry about that new and independent object as distinct from the SIP data being signed, rather than as a computa= tional result that then needs to be stored into the SIP header.  So all= of the discussion about what to do with the JWT object is additional wg ove= rhead and, IMO, a complete distraction for the primary task of the working group.  (My guess is that there is= also added overall system complexity, but I won't press that concern, at th= is point.)
>
> Arguments that it's a general mechanism for use in other aspects of thi= s space are always appealing. However they are, so far, without merit in the= working group context: There are no specifications for any of those other u= ses.
>
> And the wg still hasn't resolved the very basic and very essential step= of putting the signature into the SIP header.
>
>
>
>>     If we would NOT use JWT we would
>> probably have to define more STIR-specific procedures regarding the=
>> calculating/encoding of the signature ourselves. It's better to use= a
>> standardized mechanism in my opinion.
>
> Well, yeah, I thought/think that too, which was why I originally sugges= ted adapting DKIM. (DANE might be another relevant choice.)  DKIM offer= s an extremely high point of departure for SIP header signing.  The con= tinued lack of complete specification details about use with SIP demonstrates that JWT doesn't.
>
>
>> I am also the one who raised the encoding issue in Berlin. But that= was
>> not related to the usage of JWT as such, but to the fact that we do= n't
>> carry the encoded JWT object in one piece in the SIP message. We "s= plit"
>> the object into two pieces, and carry one piece as the Identity hea= der
>> field value, and the other piece as the canon header field paramete= r
>> value.
>
> Right.  And the point I'm raising is not about the details of that= choice but the fact that it still hasn't been made at this very late stage.=
>
> Besides merely being a missing, essential bit of system specification, i= t suggests that the wg is still not completely clear about the concrete use o= f this capability.
>
>
> d/
> --
>
>  Dave Crocker
>  Brandenburg InternetWorking
>  bbiw.net
>
> _______________________________________________
> stir mailing list
> stir@ietf.org
> https://www.ietf= .org/mailman/listinfo/stir
____________________= ___________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman= /listinfo/stir
= --Apple-Mail-8975C242-323F-43B1-AF11-A01F428AFD57-- From nobody Sun Jul 31 15:04:18 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4EAFC128B44 for ; Sun, 31 Jul 2016 15:04:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.019 X-Spam-Level: X-Spam-Status: No, score=-2.019 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (768-bit key) header.d=shockey.us Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0e2hlqFnB7vv for ; Sun, 31 Jul 2016 15:04:13 -0700 (PDT) Received: from qproxy4-pub.mail.unifiedlayer.com (qproxy4-pub.mail.unifiedlayer.com [66.147.248.250]) by ietfa.amsl.com (Postfix) with SMTP id E92C0120727 for ; Sun, 31 Jul 2016 15:04:12 -0700 (PDT) Received: (qmail 21612 invoked by uid 0); 31 Jul 2016 22:04:11 -0000 Received: from unknown (HELO cmgw4) (10.0.90.85) by qproxy4.mail.unifiedlayer.com with SMTP; 31 Jul 2016 22:04:11 -0000 Received: from box462.bluehost.com ([74.220.219.62]) by cmgw4 with id RZz51t00N1MNPNq01Zz8qS; Sun, 31 Jul 2016 15:59:11 -0600 X-Authority-Analysis: v=2.1 cv=TIHWFTVa c=1 sm=1 tr=0 a=jTEj1adHphCQ5SwrTAOQMg==:117 a=jTEj1adHphCQ5SwrTAOQMg==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=MKtGQD3n3ToA:10 a=1oJP67jkp3AA:10 a=ZZnuYtJkoWoA:10 a=8WrITzYgnNwA:10 a=fGh7L_e3oJcA:10 a=cAmyUtKerLwA:10 a=jqBRFv0mrdUA:10 a=PeFO9FbFhS32YxYntvkA:9 a=ll-iCDY8AAAA:8 a=M0OflfRGAAAA:8 a=48vgC7mUAAAA:8 a=yPCof4ZbAAAA:8 a=0FD05c-RAAAA:8 a=w1VtefKfAAAA:8 a=k7Ga1wGzAAAA:8 a=hGBaWAWWAAAA:8 a=b8OvNEjoAAAA:8 a=H6a27rHQTCv8QhYuVLcA:9 a=R1q4_3SKjNb_OP2e:21 a=jVfCNFjSKRsXVbyd:21 a=QEXdDO2ut3YA:10 a=ivbTfD_dPm4A:10 a=yMhMjlubAAAA:8 a=SSmOFEACAAAA:8 a=k-VgjUayQLU6O5rn:21 a=U0lq39m2DQiiobeZ:21 a=vSxtA0s0qwrdJr8q:21 a=gKO2Hq4RSVkA:10 a=UiCQ7L4-1S4A:10 a=hTZeC7Yk6K0A:10 a=frz4AuCg-hUA:10 a=vECW0zx54cF425OfbGUA:9 a=n3BslyFRqc0A:10 a=NWVoK91CQySWRX1oVYDe:22 a=VpyrLIdO_Ztbr3SWPBuH:22 a=6yl0mh0s51TKORVA8GqK:22 a=w1C3t2QeGrPiZgrLijVG:22 a=2lfDSYhZ3Z6b8uxcDO-Z:22 a=l1rpMCqCXRGZwUSuRcM3:22 a=xm8PXHvXF9WL09pmvKgj:22 a=ijMaxGghyylP-n2pFjDB:22 a=Q-ofuW86YyylptHqTH-7:22 a=xfJ8-ueq0pyqlCF7aVox:22 a=BKKCjISod1eDJeS0ORpz:22 a=zjWhRoSqWz9hl55Hdlzg:22 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=shockey.us; s=default; h=Content-type:Mime-version:In-Reply-To:References:Message-ID:To: From:Subject:Date; bh=LrBKAC2Wj2x40uFTgrGg8aeuMOKus9sS7zfIZVSSU88=; b=isF2fZi cmhoF+iHzSydwSMrw1J/eatbkBknaV3ur5GbKHM9CIxyhoPG/Tt4pI+xf42Z28AB69ZgYcrmNgHKO 9atpQF+u47uIopY4J8lS1x2D0d6mn6QPYedjlSptw0+U; Received: from [100.36.21.178] (port=65131 helo=[192.168.1.152]) by box462.bluehost.com with esmtpa (Exim 4.86_2) (envelope-from ) id 1bTylE-0001J4-Vu for stir@ietf.org; Sun, 31 Jul 2016 15:59:05 -0600 User-Agent: Microsoft-MacOutlook/f.18.0.160709 Date: Sun, 31 Jul 2016 17:59:04 -0400 From: Richard Shockey To: "stir@ietf.org" Message-ID: Thread-Topic: [stir] Review of: draft-ietf-stir-passport-05 References: <07e0eb16-6758-cdf1-c571-1f1ed768e741@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B476FE6CB@ESESSMB209.ericsson.se> <7f35b810-0eca-5140-060e-4aef03449c21@dcrocker.net> <7594FB04B1934943A5C02806D1A2204B477074D5@ESESSMB209.ericsson.se> In-Reply-To: Mime-version: 1.0 Content-type: multipart/mixed; boundary="B_3552832744_1985436438" X-Identified-User: {3286:box462.bluehost.com:shockeyu:shockey.us} {sentby:smtp auth 100.36.21.178 authed with richard+shockey.us} X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box462.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - shockey.us X-Source-IP: 100.36.21.178 X-Exim-ID: 1bTylE-0001J4-Vu X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: ([192.168.1.152]) [100.36.21.178]:65131 X-Source-Auth: richard+shockey.us X-Email-Count: 0 X-Source-Cap: c2hvY2tleXU7c2hvY2tleXU7Ym94NDYyLmJsdWVob3N0LmNvbQ== Archived-At: Subject: Re: [stir] Review of: draft-ietf-stir-passport-05 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 31 Jul 2016 22:04:16 -0000 > This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --B_3552832744_1985436438 Content-type: multipart/alternative; boundary="B_3552832744_856862652" --B_3552832744_856862652 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable Yep=E2=80=A6 +1=20 =20 Dave whats the problem here? What do you want? =20 =20 We choose JWT for a perfectly rational and technically elegant reasons. We= do know what data we want assert and sign.=20 =20 On one point we totally agree. I have been less than satisified on how this= actually looks on the wire. Examples. Jon has acknoledged this in his prese= ntation in Berlin. =20 =20 Fine picture from my presentation to the Genband conference BTW.=20 =20 Where do the claims go in the INVITE. I=E2=80=99m prepared to accept less than p= erfect since I know there are other bodies ready to provide guidence in orde= r to accelerate adoption among the vendor community.=20 =20 We think it will work and we have virturilly the entire US voice communicai= tons industry using E164 addressing, as well at the NRA in the US and elsew= here lined up ready to GO.=20 =20 I support the last call I have trust the authors can provide revisions that= can address some of the issues raised.=20 =20 =20 Richard Shockey Shockey Consulting LLC Chairman of the Board SIP Forum www.shockey.us www.sipforum.org richardshockey.us Skype-Linkedin-Facebook rshockey101 PSTN +1 703-593-2683 =20 =20 =20 =20 From: stir on behalf of Victor Pascual Date: Sunday, July 31, 2016 at 2:44 PM To: Christer Holmberg Cc: Chris Wendt , "dcrocker@bbiw.net" , "Peterson, Jon" , IETF STIR Mail List <= stir@ietf.org> Subject: Re: [stir] Review of: draft-ietf-stir-passport-05 =20 Fully agree On 31 Jul 2016, at 19:54, Christer Holmberg wrote: Hi, I agree with Chris. JWT is NOT a mechanism to sign any arbitrary JSON struc= ture. JWT is a mechanism to sign data, and it uses a specific JSON structure= (header, claims etc) for doing so. In addition, it provides a mechanism to = signal what data/algorithm is used to calculate the signature. Regards, Christer Sent from my Windows Phone From: Chris Wendt Sent: =E2=80=8E31/=E2=80=8E07/=E2=80=8E2016 00:08 To: dcrocker@bbiw.net Cc: Christer Holmberg; Peterson, Jon; IETF STIR Mail List Subject: Re: [stir] Review of: draft-ietf-stir-passport-05 Hi Dave, I=E2=80=99m not following your argument that because there isn=E2=80=99t a JSON object = to sign, we can=E2=80=99t use JWT? In general, most/all uses of JWT don=E2=80=99t sign an existing object, a set of = claims are constructed into a JSON payload that is signed. There are JWT defined claims precisely defined to create a secure token int= entionally meant to be only signed in a JWT. So to me, we are more than appropriately using JSON and JWT. It is in 4474bis, we define the exact information to construct the JSON pay= load object to be signed, so please refer to that. There are many advantages to using the JWT construct both for STIR charter = specifically and elsewhere. Is that a bad thing? -Chris > On Jul 30, 2016, at 9:03 AM, Dave Crocker wrote: >=20 > Christer, >=20 > Thanks for the background... >=20 > On 7/30/2016 4:30 AM, Christer Holmberg wrote: >> I am the one who originally suggested the usage of JWT. I don't >> understand the claim that JWT is "outside the context of SIP". JWT is a >> generic/standardized mechanism how to calculate and encode a signature, >=20 > Actually, it isn't. >=20 > It's own opening text [RFC 7519] says it is "a compact, URL-safe means of= representing claims to be transferred between two parties" but more importa= ntly for this issue, it goes on to say: >=20 > "encoded as a JSON object that is used as the payload of a JSON > Web Signature (JWS) structure or as the plaintext of a JSON Web > Encryption (JWE) structure" >=20 > That is, it provides value-added functions... to a JSON object (structure= ). However SIP doesn't have a JSON object to sign. So the working group ha= s had to invent a JSON-based abstraction of SIP header information and then = sign it. >=20 > Now it has to invent an encoding for the resulting signature. It would h= ave to do that for a SIP call, no matter the signature's computational abstr= action, but because that abstraction is actually an independent format, it w= ound up distracting the wg from doing a complete job -- so far, after 3 year= s -- of defining all the details for a complete authentication mechanism. >=20 > From what I can tell of the email record for the wg, the unfortunate part= of the discussion about choices here was to count JSON/JWT as something oth= er than an abstraction. >=20 > Signing an object requires defining the data over which the signature wil= l be made, and how that data will be fed into the signing algorithm. Necessa= rily, that defines an abstraction of the data. (Canonicalization seems to b= e a common component of that abstraction, for example.) >=20 > There might be nothing different or better (or, probably, worse) about JW= T in those terms; I haven't tried to evaluate it in those terms. The proble= m is that its existence as a distinct format has caused the working group to= worry about that new and independent object as distinct from the SIP data b= eing signed, rather than as a computational result that then needs to be sto= red into the SIP header. So all of the discussion about what to do with the= JWT object is additional wg overhead and, IMO, a complete distraction for t= he primary task of the working group. (My guess is that there is also added= overall system complexity, but I won't press that concern, at this point.) >=20 > Arguments that it's a general mechanism for use in other aspects of this = space are always appealing. However they are, so far, without merit in the w= orking group context: There are no specifications for any of those other use= s. >=20 > And the wg still hasn't resolved the very basic and very essential step o= f putting the signature into the SIP header. >=20 >=20 >=20 >> If we would NOT use JWT we would >> probably have to define more STIR-specific procedures regarding the >> calculating/encoding of the signature ourselves. It's better to use a >> standardized mechanism in my opinion. >=20 > Well, yeah, I thought/think that too, which was why I originally suggeste= d adapting DKIM. (DANE might be another relevant choice.) DKIM offers an ex= tremely high point of departure for SIP header signing. The continued lack = of complete specification details about use with SIP demonstrates that JWT d= oesn't. >=20 >=20 >> I am also the one who raised the encoding issue in Berlin. But that was >> not related to the usage of JWT as such, but to the fact that we don't >> carry the encoded JWT object in one piece in the SIP message. We "split" >> the object into two pieces, and carry one piece as the Identity header >> field value, and the other piece as the canon header field parameter >> value. >=20 > Right. And the point I'm raising is not about the details of that choice= but the fact that it still hasn't been made at this very late stage. >=20 > Besides merely being a missing, essential bit of system specification, it= suggests that the wg is still not completely clear about the concrete use o= f this capability. >=20 >=20 > d/ > --=20 >=20 > Dave Crocker > Brandenburg InternetWorking > bbiw.net >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir _______________________________________________ stir mailing list stir@ietf= .org https://www.ietf.org/mailman/listinfo/stir=20 --B_3552832744_856862652 Content-type: text/html; charset="UTF-8" Content-transfer-encoding: quoted-printable

Yep… +1 <= /span>

 

Dave whats the problem her= e? What do you want? 

 

We choose JWT for a perfectly rational and technically elegant = reasons.  We do know what data we want assert and sign.

 

On one point we totally agree= . I have been less than satisified on how this actually looks on the wire. E= xamples. Jon has acknoledged this in his presentation in Berlin.  =

 

Fine picture from m= y presentation to the Genband conference BTW.

 

Where do the claims go in the INVITE.  = I’m prepared to accept less than perfect since I know there are other = bodies ready to provide guidence in order to accelerate adoption among the v= endor community.

 

We think it will work and we have virturilly the entire US voice communic= aitons industry using E164 addressing,  as well at the NRA in the US an= d elsewhere lined up ready to GO.

<= span style=3D'font-size:10.5pt;font-family:Calibri;color:black'> 

I support the last call I have trust the authors can pro= vide revisions that can address some of the issues raised.

 

 

Richard Shockey

Shockey Consulting LLC

Chairman of the Board SIP Forum

www.shockey.us

www.sipforum.org

richard<at>shockey.us

Skype-Li= nkedin-Facebook rshockey101

PSTN +1 703-593-2683<= o:p>

 

 

 =

 

From: stir <stir-bounces@ietf.org> on behalf of Victor Pas= cual <victor.pascual.avila@oracle.com>
Date: Sunday, July 31= , 2016 at 2:44 PM
To: Christer Holmberg <christer.holmberg@eric= sson.com>
Cc: Chris Wendt <chris-ietf@chriswendt.net>, &q= uot;dcrocker@bbiw.net" <dcrocker@bbiw.net>, "Peterson, Jon&q= uot; <jon.peterson@neustar.biz>, IETF STIR Mail List <stir@ietf.org= >
Subject: Re: [stir] Review of: draft-ietf-stir-passport-05

 

=

Fully agree


On 31 Jul 2016, at 19:54, Chr= ister Holmberg <christer.= holmberg@ericsson.com> wrote:

Hi,

I agree with = Chris. JWT is NOT a mechanism to sign any arbitrary JSON structure. JWT is a= mechanism to sign data, and it uses a specific JSON structure (header, clai= ms etc) for doing so. In addition, it provides a mechanism to signal what da= ta/algorithm is used to calculate the signature.

Regards,

Chri= ster

Sent from my Windows Phone

= From: Chris Wendt
Sent: =E2=80=8E31/=E2=80=8E07/=E2=80=8E2016 00:08
To: dcrocker@bbiw.net=
Cc: Christer Holmberg; Peterson, Jon; IETF STIR Mail Li= st
Subje= ct: Re: [stir]= Review of: draft-ietf-stir-passport-05

Hi Dave,

I’m not following your argument that because ther= e isn’t a JSON object to sign, we can’t use JWT?
In general, most/all uses of JWT don’t sign an existing object= , a set of claims are constructed into a JSON payload that is signed.=
There are JWT defined claims precisely defined to create a = secure token intentionally meant to be only signed in a JWT.

So to me= , we are more than appropriately using JSON and JWT.

It is in 4474bis= , we define the exact information to construct the JSON payload object to be= signed, so please refer to that.

There are many advantages to using = the JWT construct both for STIR charter specifically and elsewhere.

I= s that a bad thing?

-Chris

> On Jul 30, 2016, at 9:03 AM, D= ave Crocker <dhc@dcrocker.net> w= rote:
>
> Christer,
>
> Thanks for the background.= ..
>
> On 7/30/2016 4:30 AM, Christer Holmberg wrote:
>&g= t; I am the one who originally suggested the usage of JWT. I don't
>&g= t; understand the claim that JWT is "outside the context of SIP". = JWT is a
>> generic/standardized mechanism how to calculate and enc= ode a signature,
>
> Actually, it isn't.
>
> It's = own opening text [RFC 7519] says it is "a compact, URL-safe means of re= presenting claims to be transferred between two parties" but more impor= tantly for this issue, it goes on to say:
>
>   "= ;encoded as a JSON object that is used as the payload of a JSON
> = ;  Web Signature (JWS) structure or as the plaintext of a JSON Web
&= gt;   Encryption (JWE) structure"
>
> That is, i= t provides value-added functions... to a JSON object (structure).  Howe= ver SIP doesn't have a JSON object to sign.  So the working group has h= ad to invent a JSON-based abstraction of SIP header information and then sig= n it.
>
> Now it has to invent an encoding for the resulting si= gnature.  It would have to do that for a SIP call, no matter the signat= ure's computational abstraction, but because that abstraction is actually an= independent format, it wound up distracting the wg from doing a complete jo= b -- so far, after 3 years -- of defining all the details for a complete aut= hentication mechanism.
>
> From what I can tell of the email re= cord for the wg, the unfortunate part of the discussion about choices here w= as to count JSON/JWT as something other than an abstraction.
>
>= ; Signing an object requires defining the data over which the signature will= be made, and how that data will be fed into the signing algorithm. Necessar= ily, that defines an abstraction of the data.  (Canonicalization seems = to be a common component of that abstraction, for example.)
>
>= There might be nothing different or better (or, probably, worse) about JWT = in those terms; I haven't tried to evaluate it in those terms.  The pro= blem is that its existence as a distinct format has caused the working group= to worry about that new and independent object as distinct from the SIP dat= a being signed, rather than as a computational result that then needs to be = stored into the SIP header.  So all of the discussion about what to do = with the JWT object is additional wg overhead and, IMO, a complete distracti= on for the primary task of the working group.  (My guess is that there = is also added overall system complexity, but I won't press that concern, at = this point.)
>
> Arguments that it's a general mechanism for us= e in other aspects of this space are always appealing. However they are, so = far, without merit in the working group context: There are no specifications= for any of those other uses.
>
> And the wg still hasn't resol= ved the very basic and very essential step of putting the signature into the= SIP header.
>
>
>
>>     = If we would NOT use JWT we would
>> probably have to define more ST= IR-specific procedures regarding the
>> calculating/encoding of the= signature ourselves. It's better to use a
>> standardized mechanis= m in my opinion.
>
> Well, yeah, I thought/think that too, whic= h was why I originally suggested adapting DKIM. (DANE might be another relev= ant choice.)  DKIM offers an extremely high point of departure for SIP = header signing.  The continued lack of complete specification details a= bout use with SIP demonstrates that JWT doesn't.
>
>
>&g= t; I am also the one who raised the encoding issue in Berlin. But that was>> not related to the usage of JWT as such, but to the fact that we = don't
>> carry the encoded JWT object in one piece in the SIP messa= ge. We "split"
>> the object into two pieces, and carry o= ne piece as the Identity header
>> field value, and the other piece= as the canon header field parameter
>> value.
>
> Rig= ht.  And the point I'm raising is not about the details of that choice = but the fact that it still hasn't been made at this very late stage.
>=
> Besides merely being a missing, essential bit of system specificat= ion, it suggests that the wg is still not completely clear about the concret= e use of this capability.
>
>
> d/
> --
> <= br>>  Dave Crocker
>  Brandenburg InternetWorking
>=   bbiw.net
>
> _____________= __________________________________
> stir mailing list
> stir@ietf.org
> https://www.ietf.org/mailman/listinfo/stir

___________________________= ____________________
stir mailing list
= stir@ietf.org
ht= tps://www.ietf.org/mailman/listinfo/stir

___________________________________________= ____ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/s= tir

--B_3552832744_856862652-- --B_3552832744_1985436438 Content-type: application/pdf; name="72516att.pdf" Content-disposition: attachment; filename="72516att.pdf" Content-transfer-encoding: base64 JVBERi0xLjUNCiW1tbW1DQoxIDAgb2JqDQo8PC9UeXBlL0NhdGFsb2cvUGFnZXMgMiAwIFIv TGFuZyhlbi1VUykgL1N0cnVjdFRyZWVSb290IDMxIDAgUi9NYXJrSW5mbzw8L01hcmtlZCB0 cnVlPj4+Pg0KZW5kb2JqDQoyIDAgb2JqDQo8PC9UeXBlL1BhZ2VzL0NvdW50IDIvS2lkc1sg MyAwIFIgMjQgMCBSXSA+Pg0KZW5kb2JqDQozIDAgb2JqDQo8PC9UeXBlL1BhZ2UvUGFyZW50 IDIgMCBSL1Jlc291cmNlczw8L1hPYmplY3Q8PC9JbWFnZTUgNSAwIFIvSW1hZ2U3IDcgMCBS L0ltYWdlOCA4IDAgUj4+L0V4dEdTdGF0ZTw8L0dTNiA2IDAgUj4+L0ZvbnQ8PC9GMSA5IDAg Ui9GMiAxMSAwIFIvRjMgMTMgMCBSL0Y0IDE1IDAgUi9GNSAxNyAwIFIvRjYgMTkgMCBSPj4v UHJvY1NldFsvUERGL1RleHQvSW1hZ2VCL0ltYWdlQy9JbWFnZUldID4+L01lZGlhQm94WyAw IDAgNjEyIDc5Ml0gL0NvbnRlbnRzIDQgMCBSL0dyb3VwPDwvVHlwZS9Hcm91cC9TL1RyYW5z cGFyZW5jeS9DUy9EZXZpY2VSR0I+Pi9UYWJzL1MvU3RydWN0UGFyZW50cyAwPj4NCmVuZG9i ag0KNCAwIG9iag0KPDwvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA0MTE4Pj4NCnN0cmVh bQ0KeJy1W1lv40YSfjfg/9DIQyAtxjTJ5pkEwXo8M4mDzSYbe3cWCPJAS7RMjCR6SMpe//ut qj7YTbJpIeMgiIai2NV1fnU0zc5/Zd99d/7z5dU75n//PXv77pKd/3CdsE17evL59CQIuBdm zIf/4CpOWBp4cciCyEsTttqdnpxf7YpNGbN3NfvX6Ql7//MlYwbNQNIEUpEgEyVekrE4YmkY en5kEEldRMIRkTBBruIoGXGSmUTOL5quuitWHZK66LpidV+u2e/nN/XDH+c3zw/l+a/FptoX XVXvz68Ptx3e+rEs1mUjt3x7A4Q/BCwI2c0dqENoAnj3/BBEiGIPfoDNfbbBjx9OT35fsOUf 7Oan05P3N6TCl5h5W3ddvXPz86GuO4ufARM883LQI3IxtTd88iRCo4VeErHcZwn3fM6a8vTk 49/Y/vREyBiyxAPtmlLSuoDFqZeEUxsI6kGaeRlnQYZUkacgZlHkBckxW9DiECzphYlji1ey JHAaxrmXgN4C2NePkV0QLQ1HfHKWoWeafKqliY/eK/j8bXnGF8V+XWyX+WK7TBfsH/DhsWu8 3y2jRYkXD/fLQF7ul0G8aPGq3o/U+AXMcQ4WTW3mxnY6doPILX3s4wKxweX9MlkUIHAF/za7 Aj73qIMClLFfnqWLNX57TS64n3oBt7n4S8SMfC/LTDFRxPIO5Xn/v3KFBjzAl04K/1iyX+6W 8eJOPrkqmz/PVjxt3jS32RpvwLPE44DPQBzI5j7FYTKO86kNcGls+8/Fq26QBwQO5gY3y7N4 8fUy8MXVqwoU+YkXDAS62q/ANt6rbhOkZJj5uHsFw5geH/oZu/aWZ9GCXXzCEGzADdcM/E/i Trpo0F3hBv7fTUbhlwgNzPDgpSh8BaHB3SGziw1ItEMF0ILyoFxgY/91bZl4aWDv+peIxQ1n ebeEBLJdZpA9wJAtpIw3KCiDiAgX/8UPxuBmGof+MuCL8FUFjqCSG/AzFjjKI4+neoPkWOK4 LBsG/KsRzzwe2cS/YSFUgqikFHAVNRdj2vUnnORP7grFppdHLwX7F+rLDKoP6ApCrggFS/Bf JViYvKZc6Uvh/IVimZkLwanYg1evC/hAx8f/vbaDMMDAhnpJIBcUEUGwaGu4v/970cnY91YQ MzX8vHs1BWS5F2Qvpdc/SxxiMp8nPmp3uNV7xK7ew8+8KaAakYvcrUOSc/TpI4jEM0TS3OPH 0EhmaIBzJ0qanw5YEGyfwdAMY8CEPXNtnlPTYK2NHc9izQWeaD37BosPsYMPrhgkrrV8vHZW 0HRGUIgzfyrORkSyGSKCoSOI5DNEQoj4o2wf+DNUsNKSRH5cUmNzhj2Qy2Qp+Ju96ua+3hUt Q5N/RIPcY2lTUr+0LRuXSTIKK5POvAiBW4QYilOuFHEJMhAHRYU9DTVtDhYCgg1r9TwP4QwP KYKwxP0SUX5NamjwkvpL8lPkrt7h1e4AHrvHZyoERIBH0F9VA0DSzXYJ0DlcUrVtVbvECePY i7nFyLw0fEaaBP5VkRJFyFrMgI8gxMsOwJtU7HKSIKD8blG5dj0bcvRi69kOiTekxRKSR+da GqXoQ9bSN65nY3/0rJP9eMgSw7oMgn4Fcnx0rUpyGoSYq2jFvBVmwD0G+SIFNR+LlnRekXts Oki5IlR7EHyHv3iXYB2PUTiG4E1+TNaDq8jFeB56wWC3eZ5ncknMQy89CtmCmWwSgwMFChdI rLJAb4C2HK5FiMdmhMdCAx+p9NDQAyu+mRE6S+yN5tmdyQmxz73ouKCbSQpRRmM42ewyYr9c ldVjuRb9NUj1XKO1DxQf2DFuy64jcRtCGIesCAmZTX9btJ3S2pNW2qdl7KQShrEXBTaVgjgj pEMGSsAn4Z6MpitwJZIBBDHt1NTgtrewSb0qttuWiX5XPVZQhUi4AvdFmSjhkG5XKDt9PSDH TGFRjdD0gPe3+ESxIf2I35GCUpdFYg0L6QfQA3L27JJbWSeNvCBXcu+13AwD8YCB2CiQR84N 0sjCDr2RL1DicCEHbIIHWnHFQEPFpkErCJJDrThsEnGyicmb037QJgSp/SwyUK6qtnpcKoUV qw557DMRMVi1TH0HHhOZ3OATCn92ZShVWlv8JKFpmp8o4Bh6Fj8XN7jZ18sgXNwwpCA00Dpp ANjCYosGZc7yAVcXTaH8sNy+aOA4x3ZaEKGUvN32iZy0gDPCmgxpm0j7N+nzsdzWeJc8codh gQ2Q9mJymDt0GMvNdw+ofUh6aU9TVAIAAMJtqOdSLlNNe7FDRh5DRs5tGc9cz6JSA/tZhIhq raOurXHmcbAjU6SjVod+TRZE911r35AoIQNflhFlS3p+yT5R5OUKqmlr0gByJsIR6Vl+h1oC G26KLc5gVMxK/aHO74QAsGyPy9AydKspDksuGKaNtoYF495sCGHOQjmEpjTKba7nU8NUqR9A jwjdRsR9LzwqwYQzpX4UxF6ioPuilQnFQEeCT51RmGjhI1KVCKL2DaOJJAUU4sDKrGfPYrug hSvpE7qYpZiALACXjxWGuUaMRvAjyLRY3vQLtsUzAaRL1zyL8PjEku+x6uzSW+wqRCQn7nMB /U4Mk2jF6hMeDExlssoJRUrHPtSZCooMaW97/e50XNhJ4EmHV9GUlvyECnSFv0ic0TEk4gyv ik89jDPtuCJJi3KILHGvQ/ZBS/+AhFrUWTLCfkNPk6hXYf3VRwsZD/JppYNquMYF5gm255YG B4AaQyLddy+YAEeqoXIDhbTTK8BvsmSwQrp0YqhesE7iIBprbwYYRKAYQaCnBh8fhTFWOP0T cUaW7ZNBPyMBMAGPqJ/Q0XcF7fXMaoVIGrKMaO3LDGRIQC6FomHqgZMIL6xXn4YwhlYStNBq HN1+Xsf4FoEykqCKUeOcGfBosMaVfAI/wPbJenZbiewmI9JQ/53SPmUBERv007b6hEe1Qv3/ JOWhSUXyRj3e2hlqMhIdwA6dAwC7xaEKWAsQq05kJen2ayuC+pp1hIYG8MjC8gVz9+hJaVpG m7uSVzaMEy9XXj8R1rcC8vui3PYfzSb4GnlYTUO/vsR9LKptIVaUmIDJketGIZuQpWTKfBRA PRsGboAxKpSRHv2ks9LTtiR9bUoF8bJCsjqIPgFBAHNnJR1xjm9KWDrBLtrxdBRgVreenk/L U+Mrmdx5FHrhVPU+pjIzgOJh6iWqXHu7jIzqzIx0zN8uKxbbWoGTdgKyDC6jNtssBoTGj6ju 0PbK05ULIf0dU8V93xniBtgaynZJh3pvyk4zbTaBkjFZhOOuj5Rr+8ShpSmeW4W5KhLnwwT6 FF9VcOWjzKa0bx8c6OexyO8Vzmm4GfLUOagUsRWAYEJ0MuwnXwLUkENpntqcudu+0OPcflYB ap+oLtq5Vi3MghGNvloRoEWy9BjVith84yzZ4gBLNouk0TWg9khnd9ShCvh/xCau1TDR+1CP E0zVcNXacuP6jnVqMIzthrskkFYP8YgytbtBrH6tgYUmb5XBE2NdURtov3P0bkOWzj8kw6Oj EN/L4hZ33/k8jb4frhwdOoWxP1zptnccelluP4s1Xknl4ZPugnUZgQFGEfyIeg+Ve79h9+DZ clrQllhgiyIfClVdpgxHIjIGZBRXK9H8/nL9ksEy7qVcl420GMM/FtijN3NNoTMckVlECiwi 5kvWIAZzmKtwUIwvyK2gwnGWOEmAg1Zr1WhQbC+I8KDCYk72SboUQJVNGEaE1Ka0EbkR7XYy AE5Z4SLNg6x9zecmZnS6Uejr2L6ilAMTUd/sjAZzU/VRsSvIp1SdLKcuqSpozIw+b/4k9/x8 VMzUre6kiratV1UhocN9ohAMiPUgLqsrffih20nwEJIJIlvJo5DBFCAxxhbUlxqpwKoQ9woZ dreD1k3Q7NvDttwvjbmSgaDW+LQ9kA1KPbt6UIgpkmrZeq5KJ4/xKMfSyHyNMnWsJCudEMIl io+iMnMsgtkvUznjai981PTvQgON8OBN0agyxZmPAgDWdEB7DEoCzicm8apT/KwLk5YeFRnj Cmt7Ybqdroa24kijLRVvAwMWGyqnZE/jyqLcy2Oba8sHgv4wVIwFVKksqrwn9huyVt+iE1Dh VVEl0vdY1yRG8yISKtuEMQ6Z5TkoRX6zKt/Y9qEsrQ4zuU7QTypBEzCs1LdRGXprpV4bworV CpW/FROsgg4P1Y72/uMUIUYLkw0hFH1ikwddbgyGJHqcyHQJ/cTQD/u2aF5xgY+nt8rxHM+m kKQGz5oOqkrmenvoqlrP4yRyuBzfx4bbojnQ6a3ynG6s+XtdBvYl/ra6k8CWjs61h8o6E0dX vQfim9iyJrAHtjZTsoSgnSlOVlh/hWBEtdPaSlejSaRNzvQNoPjh8vLl/jkAaMwUJgryjgGZ HD3q75v60ZmBoC7OQpt2o/xReKjMsXsNRQJOimdWqTG1zUfVS31rKUWMoEoX9oc5+Ftq8zKP 2lMHwxL7A+ghjpqDhzPnwkGSeJE6vv9AJVCDQWaUNbta+RTBTry4YqvCnvSKZvKuwlGEbEIn BgdyiGOOP/rJzYSR2wfV9uFyEQLUAxiZ6LNK7DI99IapevamznjxSE2cZzNh9kSdld30AxTE x3mPFc5lzDnJa9VgBuVV+UHODF3Vco6vL1nkyh2+10s8bvQMEb5cvRdviKeLD852A2d+sU1u EPxC2KtrHIr9h/qBK7DYr06KIHDOx/KqIz19VHv1TpW4j2WDNounX8fpsbWz/aVo1rpolmUm UmvrWpd68rY+k+qx5lngnCzn5k3HU+wBpHLUaA2d41tVC047RCJdC8fWvmw1q01hQ/nA//VU p35wnjyndJpsseV69yZM89Gzc6MGtJz57JNWGE4BS4XZjxWqgHDVUR1BTRfnx/HI8e2XI3nk 0EqHAx6vr9PeT/CN1+1BnZSNUo/ViawVQgxnt3DrCE9X7hGGXhzZnt66xvF8vMSlljwZP+t8 NTCj6sR61oA1UZoJmFnrQ9uVzuLD7iqRB1fgg6VVjGGkgoP2ADsdrJ1+TdmM029V5PfR4jBy muHxtyWNDKq5URnHFyTz8bLJvhwY3pTEvEpgqdMXzApl3hV84MBSv3E05zZdNFhKuzfPrLDq KXsqz/RZbQ/X0GvJTlZUcbdKUjEmLFtGXScrdN/21Ts8mcGsKg5qOvZLU20E68K05VfKajS5 TIyZKlJu5BBwNHDGEGwelmIMcKY6Dav4FC817PUpHv3yXC1lh7SZK52lwiGe+j99FJ22qAXI OStxhiOUoSNT5QLhFiAt7mNI3J+5iixaH7q2WutYsbqNiVrk39QV9ycqEmUS2c5JreL0+lvR Ftr4fwE/3Hx9o1VmJBPatVhVW3m8LiipfY2x7Zk86+mkK8gjN3GmabDcvDyLhUjs/3yVVNg0 FWFC0581yKaZGrWHTo9A7CMP2Atvjo+vkJPVvWiMgdaWmqcNeGtvqb2cIONpVKOd1zUWdQ5U eMrpL9syx5/kUj38fzAJMm8NCmVuZHN0cmVhbQ0KZW5kb2JqDQo1IDAgb2JqDQo8PC9UeXBl L1hPYmplY3QvU3VidHlwZS9JbWFnZS9XaWR0aCAzMTQvSGVpZ2h0IDM3L0NvbG9yU3BhY2Uv RGV2aWNlUkdCL0JpdHNQZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0ZSBmYWxzZS9GaWx0ZXIv RmxhdGVEZWNvZGUvTGVuZ3RoIDUzODQ+Pg0Kc3RyZWFtDQp4nO2deXRc9XXH/4iL4xCME6CE JC6BYBoHaAk5YKC0FEJDgAINoVCWUAphKZCUJSyhacIaCAXaQFLLlm3ZsmUL25I3eTfeLRvL i5BtzYxmk2bXzEgzI2k2zWimn/f7aZ6fNG9GQuDk2Ofd847O09Pv/ZZ77/cuv+Upn/+0lM3l tNdA7pO9NcryBhlkkEq7/PFb1ri4atqi8omrt//WtcqTx7b7ciUwtdLZ8+1Ftqma6+bVru5U tnxb7r7+i2rtsvzTuwKf7UAMMuiEp6X22Oemt3L9em9QPmntTo2rUJ5cUGvT9YAfevpOnmmS b2kvMGiNpcu0Nd8SVQtPrm5LZg3/apBBn4DGgNZpdU75ysRK86RZyvXFykHw/mJPZ5m27t3o 0aL7YCh5LEZkkEEnKo0BrZcscchX1rt6CW65qkyREdFKVfhTLVpfaQoeo0EZZNAJSZ8Gre82 h+sdPVxV5shr+0IfdSa8fZlSDe0LJk+qUFzwdxbbx4v6r1vZYcw1GWTQ6OnToHXY9eg2X7p0 KvrWwbAsVtMW/eYCKzcTZpjCyREmpgwyyCCVxoDWeZboBL1ZJq53msOlGrp6eTsFxs8wBeKZ J7b7ZflVzp5jNC6DDDrxaAxohZbYYnhS9bqhoUNWcusal275aHpgYqVZzhtv9cZfagrK8v++ zXeMxmWQQScejQGtnr6MI5bmUv+40tlTHq119h5dX3zBInu/kbsaZNDoSEXr9as6iGO5nt/d OW56ObReXu88eaaJC1xbo2muGUe6y6P1qV0BXbTSkCVabonWIIMMUklFq47jG2mWiSRUXidV tJZH63k1yrTSqbPMP1zr/tE65bp06WAl77d0HdsRGmTQiULJbO4fV7uKoXrW3LaWcEr3lXnm qExCh11425XtOrNGeM/Pz1BmpW5e41LRf6Q7JR/etNplhMIGGTRKSmdzzzYG7v/Qq72Icsu8 ss0bv3+zd9gr+4L6e5N2+OKywDLHECw/29jJQwLvjJG6GmTQ6CiXy5N7vnkg9K8fem9scD20 xff7Q92u3v4yr6QHclu98Rf3dN621s0rL+zubGjvjWcGyrwSSmarTJFHt/kof+8mz+v7QxgE A6YGGTR6CiYyd2/0TBBBKXnlGVUWuWP/lEozGExkdOC00d03TWSdZKxfmm0+bY5lvHj9Lxfa 6uw9xS/0D+TeaQ5TUkbLZ8yx0NC46a1Ewrevc9vLHgQwyCCDJNmi6XPFtqIr652LbTH8aSyd tUTSc0yRqYtsPL9qmXPYObhqsTXiCzNNj23z7w4k/PFMOJltDicJaCfNMgPbiiPdWsCmsjlc NlXR0HstXabuVDSddff244tvWeMaX2H6i+o2Xv8jD9wgg44vIl29ZLH9pIrWNw6EijPH3v6B BzYrKPvxJo/6t72dCXD6lbkWwuDiCslbgR6AXanZofSMWLu5dkU7fnpY+Uwu94dD3bh1nHKg 6K8GGWSQSv93WFkk/bfN3lIFcItXL1O2C6rYvGypA2+42dNX6pUDoeTEWeaLau3y7CqZ6cmV pgtr7ZFUyZT2V3uDRMVE3Z9iKAYZdILTJYsdZJGe0qdmoO2++LiKVkJZ7g+Gkn9W0XrbWlep D0pIemKHXxymUxBNeMz9XHOkTPlYeuDr1W1nV1tHPJyezeUOdaXw4PJy9vR/5nNU7T39L+7p 7Enr2JZ4ZgAO0G5LOJU63s7Rr3P13rXB8+BmLyFTmWJbvX3vNI9x+RvpwBl371F1QrKwq6+o RZgsJUgaNZqaycVkeaSvPTayJ5B4fV9obL0tT9H0AG2NpiRpoKqQ6hVJf8ZnVSKpLDi6sUF/ M4NKBMgEt+ctsO70J/5zjwK9mUe6y78CTvGVD2z2NfoTF39gxyDERur8T7b4qPnwSPxx9qQn VppOn2P5xnzr1+e1nTrLTKz+2W5c3OmP0xNfkQXDMly6VDFuNE3wgKFrO362YIGacxdYb2zo mH64e9i8PXbpnk2eeebBj/y8sT9EVjK2VqLpLKrybOPRGAkTATPBlPoEWb3UFEJwZ821kE+d Nsfyq73lzjjnlMX9CLKWQj9ttpk47cNCaEdweGaVZWy9LU8vNwVPmYUjK7csIqla8zkU9Vr5 WZ9VOdKdEpvq/WXKBBOZV/cpvNX25JoV7VtKR8LN4SQ2fFzF0fKnVJqf3Okvc+4VelscptOK VZfssTR4eb+lGweBBs4xRciRtWu4eGd3X790/dwDMV0vqUuu3n7sZCm0/npvEMXAbNJ0R2// 6/tDMU3NKdFWomgBi8749NwHlVB+2FwBeT19GMjpPMwWRTPpgVwpllIFlUc0c4OhZPasuW21 1lhxYYb81Xltv/xoEDIqWqm8eJ4BPFJzqUORo0FrMJGdNNv8+HY/hbmQ3cLC18B0aYOrb8IM 0093+OkMvMEp/2BVxxlVFjn2UaK1R4hMvW8v4jwUiGe0koJj5HRqqZyyN74/pHe6M5HJESG4 e/un1FjvWO/hnkuGXvSZtoaVTwtVKXa+fUIltPdaN0T/4eRta92lxrjDF58itgtynTHH8vSu wPdWtKsbDp9r7CyOBpG1+r2maUsdz+wKfHXu4MciuNng6i3V1rONgdGjdeaRiPyV0ZyudEwx OOcvtN2+3o22XLDIhvvAyPx5leWLlSZ+0g0pHdCNT4yLwAwIYKsZI/f49CvrnVgV7NL1qzp0 0frCnk58QfEa9MUfOG5b5z5nvpW2vjavbbFtEBHEhH+7TKlzYqX5u0scu8XQAonMlBrb3Rs9 Z4q+0YHV7QpPUJXrVrbTOuW/ucC6ya0YQ8zp1cud8uF3FttlV6Er6hx3bfTAz8uWOopZ9PtD 3aCPynFbD272oeHhVPZbC62kMFTFu9rCtmiaYvyJ8lMW2tAuJEjNN612TRTc+P6qDmmUkDUK gBp8pcqCm17XoSPK0aDVG8+gPKOfo0A/py6yJbNHzSBqTG9/s18JgFW0vnUwDN9kVzFscPgf VnYkMzk4r3L7b+qdtCvvsUjyK0N7g8nJ1W3/ssFDvMSQecsrMFvTFkU6skVFPeoG1eOqZc4W vQgQBaOfMmGEgsnsHevdlKdy+mCPKWpjjqTv3OCB4XTgS7PNzwtGoZhX1isqhHbxHEG/2xyW 9+cssO7WsI6eI1ndFIwuYQMxaw9t8RHW3tTQkRPLrNxfVe+8qNbOzc92+rUmCkEjd/T2GgFq mas+Ls6xki4xWK5tPp2Z5LyYvIJdPWVTqnwRWjFcp1Sa/vdjJc8ClSS/2GpgssQW+8JM04wj 3VQIHL482/KGEC5xIJom0yjehZlyuuyGBte3F9moHCajHrpoxatiGc6eb/2vj4LaXV7IFNHv DyajqYGfbvdTJzXj1kkB/m6ZEzjw661rXLAlmspivamEWK6pM0EgzagpQyWv7QshVnMkRbq0 wtmDA0L6/IlKTN0p4HbvJg8DlMafrmJFlzt7ihOHrd7452eYqI16tnnj4O4/diqWiue0i4YP y8XoJ5YBV/XgFh/aizGHUSdVtL60N4hdqjZHQVadXbE/qBA9hLfA/zcC0cWOZjRoRdfu3eSl 2h80dCy1x4qjES0hqXNrrE9sHxL+ZXI5+HbT6o68Bq2HxS7WpaKr2JxJs8z/83EXXu+8Guu3 Ftr2diYImQAjAQY3oAZoY9sp3BhI0EOaIDX+OJw8u7rtUXGEE8OOKPMiiUDE2HC8m6cvA291 9/hp0Qom4OfUhTZEjOO4Z6Pn8jpFyijDzxsDiIBxvdfSNb5CUTMQdEGtDXiiisSlSPnLs80I F6M0rc5x9fJ2tYmnxdrKHw7p5KFgnD8hqce2+QT0lHAFXE+e14ZZ+KgzIQusKuwKbgomEQFM oEWahl2dCUWa5LBAmIyJkAZ+IvFoUWgKxJTJq3XuEfNPiVaU/5Wm0FM7A8AEa+8W/o5hEi/J Yneud19e58gUoscfb/J+d4lyLk8XregYlfz3wcFD9DtKRMKQNZrGdjE0evvIVp+cE0OUiEYW YGxYD4aD5qPz2wumCQExdnAh0YqOyecv7uk8b4EV/cfgUO37LV3qrAvIxeAsKsSusrcyuwSt r5SYWoED+G51su6Zxs5zxHg/USQM4uRMVFcqS8L45oEQcTjiflIYZy6/GMXaIvc6GrTmRShY 2RrB45AuYf3KBFR0g/7/bMfwZA13cO0KRY1VtCJrwgAsAPe4CSy/uzcj0fqWkCy68PfL2x/e OiipJ3cFrhJ2ErTCZ/VDndhbhpDXoLXeHhtfYTow0uf+tGglScHTVR7pluxC+iiDs0dpgl+3 eOJ0+/HtPrTIJPbygVaVadiQHxbC3Zeaghd9YFebwFagqPS2cSjH5GHVh7Z4sQD4UKxTohCK VIiTcYx0l18x40QX0r3+83o3JfELN4sDAq9p1Em62jcOhOT88PTDQ4wDVvFMsXuqpWvkDRIS rVfUOe/b5OVCadV9UKBVFes1y9sf2nr0kDujVkCaGdBFKzaTG3XqrFTeqhI6SUAF/+XRIS1a 4SeG8e3m8DKHcqxJTUNIsoh/Gtp7JVpVEwdaCZ4BBV3CcmIGYSkRFK1j9KjBEhkcHSE0A5Rc Ba2vlkDrnRvcSET9dUFbFN7ia8aQt+YLaKWT3eIGa0x4pl4LLMNrGyVaVeL5+TW282uspTas glbk9fCWId8rkL5VqrQ2b621KidNkCZh/B0bPHmRUYLW9wonvIDzIwWteGooWm0FLZrdGpkk QKqitcqkYH9EP6JFK06NUU+YeZRXp84yWaIpfCvujM6jkMSlWrSqeAFHd4nO54vQmhfH5ZAC Nf/2QBiZSnf0kJihBWUAEBUa5vrvFl8ZvbDWhmHkRkyM5CeJLYuXie2I/7TWpd2vCKBQAJ5/ f2WH8LPKiZucmJYnXEF7T6pQotaR+DFYlTYS1pIWrYjyqoIZgYjD/+oDe0r4VsAlHYezgFZ0 kj7IcBoiVtdFqzbmZ8AECdIgUOEDmwd1gBAL0Syxx/YFE7BONcit3WlUAmdUCq3yV6SMX56s KHyApBW5yFWwvMiysQOzWpWBl0HrI9t8mFZ1duIXezrPrlayuU+JVir86w/sz42UbKKxFy92 3LPx6PI9Ok+wYRu6s1Q7YfY7EVSU2ZH+o3VuNDyhyVuJOorz1rxYXyPdgHWIdb2YIRk9WtXp fQK2s+Za8hq0wjTyQXNkhPn/Ib41mzu50jSvaNWSeBttSQvpEHWPAa15Eax+Q+AO00S0QKKN RsmpIWR0uChKR3bP7Q6cXPiAMJ4Oey5Pr+MaHi6EiFrCkRGByzOwZK/XrezAFIAvfoXb1Zbo KNdgRonWKlMUJUFk+CwyRPgvpzWIJGmR7BsFfvtgGHbJvJW+YWfwQTz/yRavLlpR45ebggwE sJMX0w2ZQcA6VAKF5DluReoe7YKa+z70YpF60gNP7lRm28BFKbTu8MW3ePvIsilPiCg/Rkfw eUNDBzlsT6FmqfZl0NrQ3oNcCAXpDFoN7uTWlzJoVfxmddvj2/3k7GiOLlq5ZwjkdOgYQ3PE 0nBSV2QoJPLF5lBtcyhJVxkOmsxbmJo9nQkYePs6NzkCrCaiJh88X4TuO31xwv7iGRT8LxWS tkvOE1VSIaiU89Wg9fQ5ZkIX+eJzjZ1yX5x0FqNEK+JWVtjFXDE13ycQp6IV/suFQjrMha46 i6Z580PRChtvWeMCF3SSgZNALRFzj5h3AglsMoDFO6B+LeHkJ0WrlOY7zV34o6+JtBRY4W0J eovXtVVq6UqBa3kQQC7xgNlSk0hyOMTJAIdO0gS57SVLHG8eCI9yfVwSwT81zDXpzPljgZ9r DKhtIZfTlBU6ZZ2OjDgmBsIwGT4mBSVksPyUqSVOEFYTG5AlKdOt89qKe4VfRveADMEe/SfA kDOQoJVrSo2V57i/9w8N6gZ2gDqpiueEc8vFMpM/kUEf1hbmxl9pCgJqEWOEGRdwoDBVtYhd 043+xAWLbHRystg6IqdQ8mJG7q2D+p+qQ2nxpwyZevhJcidXOjAUgKLOrr8ISGzAuBg78fa7 zWHgIJ/TsakLbfKbz5HUwJ0bPAqL5lvpKi5Pd3ISc4QdBl+wAhW6qNZOxpRXMvckbL93oweD gzgQDeaL5I7a5EoBsMXe6m7UIS87f6ENf8qg+Mmg1KRpTUcvVaG0coHmcJeyKPnLjwZjgGRG sXgVhbCNiIvUW97DpetFkgtaiWGuXtZOT6hq2lKHQ5jEBZboZJHAQkvsSsAjRQkb93bqBPao 3KVLHY8WPjIG8KkKC0m1+CM5UYaaIeILa+0AmfgTCNS0RUHrtDqHOm0C3h8o7C0kebyi3qkr MkmYIzh26xol99RdKNTS/WKvPk7hsJhFIccvv8cJ7KMVly5x4H2iY9rsQc6C+vXppTn0dlid cAzG2jUfj1L6kFF215AVomzqupj6HH8E26lKd0URf0dSsFc4CHWkMm/lFZ67h0Z0xGb7Q8mD oaS6fYhqKanGHtK/yLi1SyzwUVg7MZ7IDLSElb1b2qFhsctPniNBOmOKpNSQWE4N6R6nygtN c4sJT/pFzeqGbfmWuqw8II5VUrNDz7moRDYFzykGr9KFDuTEZIu6BBwQ7NofTKqipNEy0SZi OiI4Twe0S8858aJP6bnysM6urAUwcO1fVY+DyVI7QDVyTltGwnT143CKYEDVB8Si1X/KS+mU 2W5HW9rzLzDfJPqsXRaHmTyRMZJqmrQCJZ5RK+Fh8ZJ3Mf2upQsYqqmcLjFwjCEeTWrblfVO bbauS0Ro4xTTd0J9n187y2TQn4owa7ZY/+V1zu+taB+5tIaGzTIdjwQScdOA0Vpicx0Ilfnd y4V/jVFlUpBIuF5qowtWmjBAm9GfGERcavyzvD857fDHScfOnm/VDVPLEHELeYpuKnockfSD ZF7Fw8eOPbbNz1+JadUYD78vP+5EeBwp+r+QoP6Sxcp08av7QsfZbviRiBip/BczDPojEAGq I9Y/4j8kLSb8Dup6vH/AhP6/si84QSyxPbLVt8rZQ6633Rd/uzk8VSzHgD5bbIhFglfXiqVV jBU+d6s33hRMru7oJcWWX414wfj+kkEGHRsCWOtcvVcU/vmj/D6hXOj5eWNA145h4n57MKz+ Izn5P6o+J/ZX1Nt7DKQaZNAxJbzhx+HkzCOR53d3vrYv1NDeO+L/mQKzazt65VfEpx/u3h1I HHenQQ0yyCCDDDJoDPT/BdfHcA0KZW5kc3RyZWFtDQplbmRvYmoNCjYgMCBvYmoNCjw8L1R5 cGUvRXh0R1N0YXRlL0JNL05vcm1hbC9jYSAxPj4NCmVuZG9iag0KNyAwIG9iag0KPDwvVHlw ZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2UvV2lkdGggMTc0L0hlaWdodCAxNzMvQ29sb3JTcGFj ZS9EZXZpY2VSR0IvQml0c1BlckNvbXBvbmVudCA4L0ZpbHRlci9EQ1REZWNvZGUvSW50ZXJw b2xhdGUgdHJ1ZS9MZW5ndGggNjYwMT4+DQpzdHJlYW0NCv/Y/+AAEEpGSUYAAQEBANwA3AAA /9sAQwAIBgYHBgUIBwcHCQkICgwUDQwLCwwZEhMPFB0aHx4dGhwcICQuJyAiLCMcHCg3KSww MTQ0NB8nOT04MjwuMzQy/9sAQwEJCQkMCwwYDQ0YMiEcITIyMjIyMjIyMjIyMjIyMjIyMjIy MjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIy/8AAEQgArQCuAwEiAAIRAQMRAf/EAB8A AAEFAQEBAQEBAAAAAAAAAAABAgMEBQYHCAkKC//EALUQAAIBAwMCBAMFBQQEAAABfQECAwAE EQUSITFBBhNRYQcicRQygZGhCCNCscEVUtHwJDNicoIJChYXGBkaJSYnKCkqNDU2Nzg5OkNE RUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6g4SFhoeIiYqSk5SVlpeYmZqio6Slpqeo qaqys7S1tre4ubrCw8TFxsfIycrS09TV1tfY2drh4uPk5ebn6Onq8fLz9PX29/j5+v/EAB8B AAMBAQEBAQEBAQEAAAAAAAABAgMEBQYHCAkKC//EALURAAIBAgQEAwQHBQQEAAECdwABAgMR BAUhMQYSQVEHYXETIjKBCBRCkaGxwQkjM1LwFWJy0QoWJDThJfEXGBkaJicoKSo1Njc4OTpD REVGR0hJSlNUVVZXWFlaY2RlZmdoaWpzdHV2d3h5eoKDhIWGh4iJipKTlJWWl5iZmqKjpKWm p6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uLj5OXm5+jp6vLz9PX29/j5+v/aAAwD AQACEQMRAD8A9/ooooAKKKKACiiigBKKjmnit4mlmkWONRlmY4AHua4zWPiNZWxaLTYjdSDj zG+WMH+Z/T61rSo1KrtBXOeviqVBXqSsdvVe6v7SyQPdXMMCE4DSOFH6145qHjHXNRJ33rQx 5yEt/kA/Ec/maw2JZizElickk8mvRp5VN/G7HjVs/gnanG/qe2z+LtBt/v6nAf8Armd//oOa rjx14cY4/tD84XH/ALLXjNFdCyqnbVs43n9e+kUe5ReJ9DmTcuqWgH+3KFP5GtOOWOVA8bqy noQcg189VLb3NxaS+bbTywyYxujcqcfUVnPKV9mRtT4glf34fcfQdFeQ6Z4/1mxKrcOl5EMD Eow2B6MO/uc13Wi+NdK1crEZDbXLYHlS8ZPH3W6Hk8Dr7VwVsFWpatXXkeths0w9fROz7M6W ikByM0tch6IUUUUAFFFFABRRRQAUUUUAJVDWdTj0fSbi/kUssS52juScAfmRWXr/AIjFld22 lWbBtQunVASu4QhjjcR3+laeo6VFqejy6dMzlJEA3EkkEcg+/IBrRQ5XFz2f5GEqvOpRpbr8 zxvWvEGoa7Pvu5SIwcpChIRfw9eevWsutXWvD2oaHcMl1CTFn5J0BKN+Pr7GsqvqaPs+Rez2 Pg8T7b2j9te/mFFFFbHOFFFFABRRRQAUUVc0/Sr/AFWbyrG1knYdSo+Vfqeg/GplKMVeTNIQ nOVoK7Os8DeJ79dTg0qdnuLaTKpu5aLAJ4Pp7Hp+HPqFcn4U8Gx6G32u7ZJr4jClfuxj2z39 /wAPXNvxZr//AAj9jDOhVpnlAWIkfOv8We+Mdx0OPpXzeJ5K1e1FH2eC9phsLzYl7fgjoaKo aRq9rrVgl3avuRuGB6o3cEetX642nF2Z6UJxnFSjsxaKKKRQUUUUAFYnifXU0HSHuAFadzsh Q5wW9/Yda264n4jaXLd6RDeRIzNasdwHZGxk/hgfrW2HjGVWMZ7HLjZzhQlKnukcDp2rSp4l ttTu5iz+erzSMM8Zwf09K9yBBAIr546133hLxxHaW8WnaoSsaDZHOOQo7Bv5Z/8A1162Y4WU kpwWx89k+PjTlKnVe+t/M9IdFkQo6hlYYIIyDXOX/gbQ77cVtTbSNj5rdtuP+A/d/SuhhuIb iJZYZUkjYZVkbII+tSV40ak6b912PpalKlWXvpM89n+F8bSE2+qOkfZZIQxH4gj+VZb/AA11 gMQtxZlc8EuwP/oNerUV1RzDELqcM8nwkvs2PJ/+Fb63/wA9bM/9tG/+Jo/4VtrZ/wCW1n/3 8b/4mvWaKr+0q/cz/sTC+f3nlUPw01ZpVE11aJHn5mUsxH0GBn861Lf4XwLJm51OSSPHSKII fzJP8q9AzioLm8trOLzbm4ihjBxukcKPzNS8fiJaXNI5Tg6erj97MKx8DaFZbWNp9okXPzTt uz9R939K6CKKOCJY4o1SNRhVUYAFcxqXj/RbLcsEj3cgJG2Fflz/ALx4x9M1xureP9W1ANHb bbKFuMRnL9P73+AFOOFxNd3l+JE8dgsIrQtfyPQNe8U6foULCSQS3W3KW6H5ifc/wj3P4Zry XWdZu9cvjdXbDONqIv3UHoKoM7O7O7FnY5JJySe9Nr2MLgoUNd2fPY7MqmKdto9jY8Oa7NoG prOhYwOQs8Y/iX/Edv8A65r2u3njuraOeFg8cih0YdwRkGvnyvafBazL4RsBPv3bCRuOTtLH b+GMY9q4s1pRVqi3Z6WQ4ibcqL23Ogooorxj6YKKKKAKU92Y7+1tU2lpd7vnsijkj33Mg/E1 adFdCjAFSMEHvXnF74jSH4lxyvKBaQf6KzA4GCOd2fRzz/u16SDkZFbVaMqai31Vzkw2JjXc 0ujsea+JvAMkTPd6Mm+Lkvb5+Zf931+nX61wciPFI0ciMjqdrKwwQfQ19DVm6loWm6uuL20j lbGA+MMB1xuHNd2HzKUFy1NV+J5mMySFR89F2fboeJWeoXmnyb7O6lgYkE+W5AbHqO/410Fr 8QdfgBEksFxnp5sWMf8AfOK2tQ+GX3m02++kdwv/ALMP8K5m+8Ha7YZL2DyoG2hofnz74HOP qK71Vwlfe1/M8l0Mwwvw3t5ao2oviZqan99Z2r/7u5f6mp2+J9wR8umRg+8xP9K4SWKSCVop o3jkU4ZHGCPwplX9Rwz+yZf2njI6OR2j/EvVjny7W0X/AHgx/rVef4ia9Mm1GtoDn70ceT/4 8TXJ0VSwVBfZIlmWKlvNmxdeKtdvAvm6nONvTyiI/wD0HGaypJZJpDJK7SSMclnOSaZRW8aU IfCrHLOvUqfHJsKKKKsz1CitCw0PVNTK/Y7GaVWzh9uE4/2jx+tdpo/w2wyzavcZA58iE8Hp 1b8xgfnXNWxdKkveZ2YfAYiu/djp3OX8NeGrjxBegYdLND++mA6ew9T/ACr1bWbpNE8N3MsJ WHyISsOF4U4wox064q2iWek2O1BFa2sQz2VVHUmvK/GHis69cC2tgVsYmypI5kb+8fQeg/P0 HlXqY6stPdR77jSyvDvW82ep6VqEeqaXb3sWNsyBsA52nuPwORVyuE+Gl+02nXdi5J8hw6ZP QN2A+oJ/4FXd1wYil7Ko4dj1sHX9vQjU7i0jfdNLRWR0nz9fmc6jdG6AFx5z+aB2fJz+td94 P8bIYk07VpQjIMRXDnAYejHsffv9es/jfwjJqDNqmnpuuAP30IHMgHce49O/16+ZsrIzK6lW BwQRgivooqljaKXVfgfGzdfLcS5LZ/ifQ4II60V4xonjHVNFCxCT7Tar/wAsZT0HH3T1HT6e 1d7pfj7R78KlxIbOY4BWX7ucc4bpj64rya2BrUntdeR7+FzXD11Zuz8zqqKiguIbmJZYZUkj YZVkYEH6Gpa47WPSTTWhHLBDPG0csSSIwwVYZBrLuPCmhXKbH0u3A/6ZpsP5rg1s0lVGco7O xEqVOfxJM5iXwB4fdcJaPGfVZnz+pNUj8NNIJJFzegem9eP/AB2u0orVYqsvtMwlgMM94L7j iv8AhWek/wDP1ff99p/8TSr8NNIBBNzekehdf/ia7TI9aq3WpWNjj7VeQQbunmSBc/nVLFYh 7SZm8Bg46uCMOLwD4eRcNZvIfVpnz+hFalroGk2bI9vp1tG6fdcRjcPx61j3nxA0K1H7uWW5 YNgrDGePfLYGPpXNX/xLvZcrY2cUA5G6Ri5I7HsAfzrWNDF1t7/M554rL8Pta/kj0xmjjQux VVUZJJwBXLax4+0rTsx2rfbZvSI/IOnVunftnpXmWoazqWqtm9vJZhkHaThQR/sjiqFdtHK0 taruebiM+k1y0Y282a2s+ItR12TN3NiJTlYU4RffHr7n1rJoor1YQjCPLFWR4NSrOrLmm7s7 H4ak/wDCSTe9q3/oS16vXC/DnRpLWym1KeMq1xhYtw52Dv8AQn+QPeu6r5vHzU67aPtMppyp 4WKl11FqrfXaWNo9zJgRoRvJ7DIBP4datVleJFDeGtTBGf8ARpD+Sk1yRSckmehUk4wbRqda 53X/AAhp2u7pWBguz/y2jHXjA3Dv29+OtVPA3iIarpos7hx9stlAOWyZE7N/Q/8A1662tX7T D1LLRowj7HGUU2rpni2seD9X0hmdoDcW4yfOhG4Ae46jp9PesCvogjIrI1Hwxo+qMXurGMyE 5MifIxPuRjP416NHNWtKiv6HjYjIU3ejK3kzxOC5uLWTzLeeSGTGN0blTj6iteDxh4gtohHH qcpUdPMVXP5sCa6y8+GMJ5stRkTj7syBsn6jGPyrn7r4f6/bkeXFDcZ6+VKBj/vrFdixOEq/ Fb5nnSwWPw/w3+TJoviNriIqstrIQOWaM5P5ECn/APCyda/54WX/AH7b/wCKrAl8P6zBIyPp d3lepWFmH5jg1nMrIxV1KsDyCOlUsNhZbJGUsZjoaSk0defiRrZH+qsh9I2/+Kqi/jjxE5Y/ 2htB7LEnH6VztFaxwlBbRRlLHYqW82X59b1W53ibUbt1f7ymZtp/DpVCiitowhH4Uc8qlSes m2FFFT21ld3m77Nazz7evlRlsflTcklqyVCUnZIgorfs/BmvXgRlsGiRjjdMwTH1B+b9K6LT /hk52tqN8B1zHbrn6fMf8K56mNoQ3kdlLLcTV2i/mcAqs7hEUszHAUDJJ9q7nwz4ClndLvWE McPDJbn7z/73oPbr9K7bTPD2k6Im61tkRwPmlf5nPryeg46Diua8SeP4bdWtdHZZpiCDcfwJ 9P7x/Tp1rz54yriHyUF8z1aeXUMGva4qV32NHX/EMNlqGn6NaOPPluYRIE/5ZpuHH49Memfa uqHSvDtASe98UaecvLK10kjljknB3MSfoCa9yHSuPGUFQcY9T08txUsTz1HteyCmTRJNC8Tg MrqVYHuDT6K4j02rqzPCry1v/DWtlA7xXED7opQMbh2YexHb6g969N8M+MbTW0S3mKw3+OY+ zkdSp/p1+vWrviHw3aeILUJL+7nQfu5gOV/xHtXkOqaRfaJeeReRFGBOxx918d1P5V7UXSxs EpaTR8zNV8squUNabPeaK8n0T4gahYbYb5ftkA43E4kHTv379efeu60zxhoupqoS7WGU4HlT /I2T29D+BNefWwdWlutD18NmWHrrR2fZm/RSBgehFLXKegJik2L6CnUUCsilcaTp12we5sba Zh0aSJWP6ioP+Ec0X/oE2P8A4Dr/AIVp0tUpyXUh0qb3SMv/AIR3Rf8AoFWX/gOv+FH/AAjm i/8AQJsf/AdP8K06r3V/aWSB7q5hgUnAaRwo/WmpzezZLp0o6tILewtLNNltbQwqTkrGgUfp U+0DsK5i+8f6FaBhHO9y4baVhTP45OAR9DXL6h8Sr6bclhaxW68gPId7exHQA/nXRTwdep0+ 85KuY4Sh1+49NlljgiaSR1REBZmY4AA7muV1f4gaVp+6O1zezDtGcIOnVvx7ZrzG/wBW1DVJ N97dyzc5CsflH0A4H4VSr0KOVJa1Hc8fEZ9OWlFW82bOs+KNU1slbmfZB2gi+VO3X16d6xqK kggluZ0ggjaSWQ4VVHJNepCEKUbRVkeHOpUrzvJ3Z0/w9snufEy3A3BLaNnJC8ZI2gE/iT+F eu1geFPD66BpflsQ1zKd8zAd+yj2H9T61v181jKyq1nJbH2uWYZ4fDqMt3qxaKKK5T0CKWVY E3vkKCASATjnH5e/brUN9YWmpWrW95Ak0TdVYfqPQ+4qeWJJo2jkRXRwVZWGQQexrmk1lvD1 +mm6vIzW0h/0W9buP7sh9R/e7jBOOauEZP4dzGrOMdKi0Zzet/Dm4iZptIkE0Z58iQ4cdOAe h79cfjXE3NpcWU5huYJIZR1WRSDX0CrBgCCCD3FQXVja30PlXVvFNHnO2RARn8a76OZVIaT1 R5OJySlU96k+V/geF2mq6hYYFpezwqDkKkhC5+nStq38e+IIH3PdRzjH3ZIlx/47g11+ofDf Srnc1nJLaPjAAO9PqQef1rm7z4cavAXNtLb3Kj7oyUZvwPH612rE4Ot8SXzR5ksFmOH+Btry Yf8ACyda/wCeFl/37f8A+Kp3/CytY2j/AEay3dztbH/oVYdz4X1y0YCXS7g5H/LNfMH/AI7m sya3ntpCk8MkTjqrqVP61rHDYSXwpfeYSxuPh8Ta+R1v/Cyda/54WP8A37f/AOKqpcePvEEz ZS5jgH92OIEf+PZrmaK0jg8OtooxlmGLlvNmpceI9aunLS6ndc8EJIUH5DArMJLEknJJ5JpK K3jCEfhSRzSqVZ/E2woq1Bpt9dKWt7K5mUd44mb+QrStvB+v3ahk02RVJ6yMEI/AnNKVanHe SQ4YatP4Yt/Iw6K7mz+Gd9Ju+2X0EI4wI1Lk/XOMfrXUaf4F0PTv3kkJuXBJDXDbgB6Y4X8x XJUzKjD4dT0KOTYmprJcq8zzTSPDmqa43+iQYi7zSfKg/Hv+Fd5Bp+meCbRdmLvV7kiOENgM 7HgAD+Fc9T+vQUuu+PbLT0NvpQS6nHG8f6pPxHXt0496oeB9Mu9V1KTxDqUjylSVhL5yzd2H bA5AHTr0xXJWq1akHOp7se3c78PQoUaqpUfen36I720ieC0jjlkMsgHzuf4m7nHbnt26VPR2 orxz6RKysLRRRQMSqWp6Xa6vYvaXcYeNvzU+o96u0U02ndEyipK0tjzOX+3/AAJNthJvNJzk bh8qgnp/sn9Dn1rodJ8faRqAVLhzZzHgrKflz/vdPzxXUSRpLG0ciBkYYYMMgiuM1v4d2d4W m02T7JKcnyyMxk8/iv4cD0rtjVo1tKys+6/U8udDE4bXDvmj/K/0OyimjnjWSKRXRhlWU5BF SV4rdaP4i8NvI4W5gj/imt3OxgD1JX696tWvj/X7c5kniuBjAEsY4/75xVvLpSV6Uk0ZrOYw fLXg4s9go2j0H5V5pb/E+5WPFxpsUj+qSlB+RBq7D8T7Yj9/p0yH0Rw3+FZPAYhfZOiObYOX 2vwO6ktoJl2ywo6+jKDVQ6JpR5Om2f8A34X/AArlv+Fm6b2srv8AJf8AGq8vxQhH+p0yR/8A flC/0NJYTE9IsJZjgt3JfcdrFpenwHMVlbxn1WID+lWtijoo/KvN5vifO0ZEOlxo/ZnmLD8s Csu4+IevTR7Y2t4D/ejiyf8Ax4kVosvxEt1+JjLN8FD4dfRHrnyjsKoX+t6Zpgb7ZewwsF3b C3zEey9T+FeN3niLWL8sbjUbhgy7WVX2qR/ujArLrphlL3nL7jjq5/H/AJdQ+89N1P4k2cO6 PTrZ7h+QJJPkTp1x1P04ridW8TarrXy3dyRDnIhj+VPy79O+arafo+o6q+2ys5ZhnBYDCg9e WPArvdD+H1rbTrLqsyXMy/MIE+4Oe/du3oOvWtmsJhFfd/ecqlj8e7bR+5HM+F/CVzrsyTyq 0VgG+aQ9X9Qv+PavX4YY7eBIYkVI0UKqgcADtSxxpFGscaKiKMKqjAAFPrysTiZV5Xex9Bgs DTwkLR1b3YtFFFcx3BRRRQAUUUUAFVruO4eMG2nEUqnI3LuU+xGQfyI/obNJQhNXVjnn8UQ2 E62+t2slhIxIWT/WRPzjhx7c8gYqSbRvDuvRmcW9pcBmy0sLAEn3ZTk1r3FtBdwNDcQpLG33 kdcg/ga4vUvh4iy/adDu3s5hysbMcA8dG6jv6/hXTScG/icX+Bw141UtYqa7df8AIfdfDTTZ Q5tbq4gYn5Q2HVfw4J/Osm5+GN6gH2XUIJT38xCn8s1Xnm8caCjRtJdPECT5gUTjA75IJA+u KjT4ka2qgGOzf/aMbc/k1ehBYu16c1JHj1JZfe1Wk4sH+HGtquRJaOR2WRv6rVI+BvEYJA0/ PuJk/wDiq2IPideqP3+nwSH1Ryn+NTH4oS9tKX/v/wD/AGNaqePXRGLp5U/tNf16GHH4E8RO 4VrJYx/eaZMD8jV5fhrrJPzT2QH++3/xNOl+Jeqs+YrW0RfRgzH+Yqq/jrxJfTpHbSLG54Ec EAYt+eTTcsa97IlRyyO3NI3Lf4YxK4a61N3THKxxhTn6kn+VTPaeCfDqnzjFdXCBlKu3nMSO xX7oP1ArEg8O+K/EGDfTzxW7kMftMhA69k9fqBXW6L4D0zS2WWcfbLgchpR8o+i/456VyVal l+8qX8kd+Hocz/c0VFd5f5DbHUtX14p/Ztr/AGZpv/PxMgMjrgEbF6D0ycjn2xXR2VlFYweX HvYk5eSRizufViep4H5AdAKs4Aorzpz5tlZHtUqXIryd2LRRRUGwUUUUAFFFFABRRRQAUUUU AFFFFACYHeqd1pWn3rh7qxt52AwDJErEfnVyimm1sTKEZaNHPSeCPDsjlm05QSc/LI6j8gaT /hBPDn/QPP8A3/k/+KroqK09vV/mf3mP1TDv7C+5GHb+D9AtWLR6ZET/ANNMyf8AoRNa1vaW 1pEI7eCOFB0WNQo/IVNRUyqTl8TuXCjTh8MUhaKKKg1CiiigAooooAKKKKAP/9kNCmVuZHN0 cmVhbQ0KZW5kb2JqDQo4IDAgb2JqDQo8PC9UeXBlL1hPYmplY3QvU3VidHlwZS9JbWFnZS9X aWR0aCA3MS9IZWlnaHQgMzkvQ29sb3JTcGFjZS9EZXZpY2VSR0IvQml0c1BlckNvbXBvbmVu dCA4L0ZpbHRlci9EQ1REZWNvZGUvSW50ZXJwb2xhdGUgdHJ1ZS9MZW5ndGggODQ0OT4+DQpz dHJlYW0NCv/Y/+AAEEpGSUYAAQEBAGAAYAAA/+ERBEV4aWYAAE1NACoAAAAIAAQBOwACAAAA EwAACEqHaQAEAAAAAQAACF6cnQABAAAAJgAAENbqHAAHAAAIDAAAAD4AAAAAHOoAAAAIAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABI RVJOQU5ERVosIENJTkRZIFMAAAAFkAMAAgAAABQAABCskAQAAgAAABQAABDAkpEAAgAAAAM2 NwAAkpIAAgAAAAM2NwAA6hwABwAACAwAAAigAAAAABzqAAAACAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMjAxNjowNDoxNCAxMjoz NTo1MQAyMDE2OjA0OjE0IDEyOjM1OjUxAAAASABFAFIATgBBAE4ARABFAFoALAAgAEMASQBO AEQAWQAgAFMAAAD/4QslaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQg YmVnaW49J++7vycgaWQ9J1c1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCc/Pg0KPHg6eG1wbWV0 YSB4bWxuczp4PSJhZG9iZTpuczptZXRhLyI+PHJkZjpSREYgeG1sbnM6cmRmPSJodHRwOi8v d3d3LnczLm9yZy8xOTk5LzAyLzIyLXJkZi1zeW50YXgtbnMjIj48cmRmOkRlc2NyaXB0aW9u IHJkZjphYm91dD0idXVpZDpmYWY1YmRkNS1iYTNkLTExZGEtYWQzMS1kMzNkNzUxODJmMWIi IHhtbG5zOmRjPSJodHRwOi8vcHVybC5vcmcvZGMvZWxlbWVudHMvMS4xLyIvPjxyZGY6RGVz Y3JpcHRpb24gcmRmOmFib3V0PSJ1dWlkOmZhZjViZGQ1LWJhM2QtMTFkYS1hZDMxLWQzM2Q3 NTE4MmYxYiIgeG1sbnM6eG1wPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvIj48eG1w OkNyZWF0ZURhdGU+MjAxNi0wNC0xNFQxMjozNTo1MS42NjU8L3htcDpDcmVhdGVEYXRlPjwv cmRmOkRlc2NyaXB0aW9uPjxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSJ1dWlkOmZhZjVi ZGQ1LWJhM2QtMTFkYS1hZDMxLWQzM2Q3NTE4MmYxYiIgeG1sbnM6ZGM9Imh0dHA6Ly9wdXJs Lm9yZy9kYy9lbGVtZW50cy8xLjEvIj48ZGM6Y3JlYXRvcj48cmRmOlNlcSB4bWxuczpyZGY9 Imh0dHA6Ly93d3cudzMub3JnLzE5OTkvMDIvMjItcmRmLXN5bnRheC1ucyMiPjxyZGY6bGk+ SEVSTkFOREVaLCBDSU5EWSBTPC9yZGY6bGk+PC9yZGY6U2VxPg0KCQkJPC9kYzpjcmVhdG9y PjwvcmRmOkRlc2NyaXB0aW9uPjwvcmRmOlJERj48L3g6eG1wbWV0YT4NCiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgPD94cGFja2V0IGVuZD0n dyc/Pv/bAEMACAYGBwYFCAcHBwkJCAoMFA0MCwsMGRITDxQdGh8eHRocHCAkLicgIiwjHBwo NyksMDE0NDQfJzk9ODI8LjM0Mv/bAEMBCQkJDAsMGA0NGDIhHCEyMjIyMjIyMjIyMjIyMjIy MjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMv/AABEIACcARwMBIgACEQEDEQH/ xAAfAAABBQEBAQEBAQAAAAAAAAAAAQIDBAUGBwgJCgv/xAC1EAACAQMDAgQDBQUEBAAAAX0B AgMABBEFEiExQQYTUWEHInEUMoGRoQgjQrHBFVLR8CQzYnKCCQoWFxgZGiUmJygpKjQ1Njc4 OTpDREVGR0hJSlNUVVZXWFlaY2RlZmdoaWpzdHV2d3h5eoOEhYaHiImKkpOUlZaXmJmaoqOk paanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4eLj5OXm5+jp6vHy8/T19vf4+fr/ xAAfAQADAQEBAQEBAQEBAAAAAAAAAQIDBAUGBwgJCgv/xAC1EQACAQIEBAMEBwUEBAABAncA AQIDEQQFITEGEkFRB2FxEyIygQgUQpGhscEJIzNS8BVictEKFiQ04SXxFxgZGiYnKCkqNTY3 ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqCg4SFhoeIiYqSk5SVlpeYmZqi o6Slpqeoqaqys7S1tre4ubrCw8TFxsfIycrS09TV1tfY2dri4+Tl5ufo6ery8/T19vf4+fr/ 2gAMAwEAAhEDEQA/APf6KKhnmS3t5JpW2xxqWZj2AGSaAJqK8y8FfF6Dxjr9xpa6S1oywvLb O1xv+0BTjgbRjoe56GsnU/jJ4j0Z7ZNR+Hd1bNdSeVB5l/jzG7Afu+vIoA9jorzR/ibqmneH tT1jxD4Pu9JS12LBHJcBjcO5ICg7V246k88VJ4e+Jt3qPii00DWfDkmk3V7bfaLU/aRMJFwW 5wq7eAfXpQB6PRXkWtfF7xHoAMmofD26itzL5Ucz32A7ZIGP3Z64rq/CHivX/EN3PFqvhG50 OJIw8cs0/mCQk9ANq445oA7KikBzRQAteffGTxAdC+H12kLYur9haQgdSW+9j/gINeg1y/iP wbB4k13Q9SubqRY9KleVbYKCsrNtwWz6Y/U0AeE3fibRtFn8FX2kW9/FJoyi3vGmtmjWRGOW O7vyXOPevQPjPIs1z4HkjIZH1ZCpByCCVxXoXijw5a+KfDt3o90SkdwuPMUAlCDkEVz2ofDe PUtG8Nafc6rcOdClSSOYxjMwXGFYZ44UDNAGR8Y76S80/TvB9tZJPea3OEjeRiFh2sDu4xzn 9M9a85sby9+G3ie6Gv2M+q+JViS30eaWQtAUJ2nb3HBx+Y4yc+1eNfAln4zhtHe6nsb6zk8y 2uoD80Zznp+Gc9Qa5u4+C1pq73Nzr+v6lql9JGEguZSFNvg5BUA4P06UAQ/GJrp/AOkNerGt 0b+3Myx52h+4Ge1erQ/6iP8A3R/KuL1TwA+t+EdP0HUdZuJns50lF20Y3OFJwGGfTjNdrGux FX0GKAH0UUUAFFFFABRRRQAUUUUAFFFFABRRRQB//9kNCmVuZHN0cmVhbQ0KZW5kb2JqDQo5 IDAgb2JqDQo8PC9UeXBlL0ZvbnQvU3VidHlwZS9UcnVlVHlwZS9OYW1lL0YxL0Jhc2VGb250 L1RpbWVzIzIwTmV3IzIwUm9tYW4vRW5jb2RpbmcvV2luQW5zaUVuY29kaW5nL0ZvbnREZXNj cmlwdG9yIDEwIDAgUi9GaXJzdENoYXIgMzIvTGFzdENoYXIgMzIvV2lkdGhzIDc4IDAgUj4+ DQplbmRvYmoNCjEwIDAgb2JqDQo8PC9UeXBlL0ZvbnREZXNjcmlwdG9yL0ZvbnROYW1lL1Rp bWVzIzIwTmV3IzIwUm9tYW4vRmxhZ3MgMzIvSXRhbGljQW5nbGUgMC9Bc2NlbnQgODkxL0Rl c2NlbnQgLTIxNi9DYXBIZWlnaHQgNjkzL0F2Z1dpZHRoIDQwMS9NYXhXaWR0aCAyNTY4L0Zv bnRXZWlnaHQgNDAwL1hIZWlnaHQgMjUwL0xlYWRpbmcgNDIvU3RlbVYgNDAvRm9udEJCb3hb IC01NjggLTIxNiAyMDAwIDY5M10gPj4NCmVuZG9iag0KMTEgMCBvYmoNCjw8L1R5cGUvRm9u dC9TdWJ0eXBlL1RydWVUeXBlL05hbWUvRjIvQmFzZUZvbnQvQUJDREVFK1RhaG9tYS9FbmNv ZGluZy9XaW5BbnNpRW5jb2RpbmcvRm9udERlc2NyaXB0b3IgMTIgMCBSL0ZpcnN0Q2hhciAz Mi9MYXN0Q2hhciAzMi9XaWR0aHMgNzkgMCBSPj4NCmVuZG9iag0KMTIgMCBvYmoNCjw8L1R5 cGUvRm9udERlc2NyaXB0b3IvRm9udE5hbWUvQUJDREVFK1RhaG9tYS9GbGFncyAzMi9JdGFs aWNBbmdsZSAwL0FzY2VudCAxMDAwL0Rlc2NlbnQgLTIwNy9DYXBIZWlnaHQgNzY1L0F2Z1dp ZHRoIDQ0NC9NYXhXaWR0aCAyMTE1L0ZvbnRXZWlnaHQgNDAwL1hIZWlnaHQgMjUwL1N0ZW1W IDQ0L0ZvbnRCQm94WyAtNjAwIC0yMDcgMTUxNiA3NjVdIC9Gb250RmlsZTIgODAgMCBSPj4N CmVuZG9iag0KMTMgMCBvYmoNCjw8L1R5cGUvRm9udC9TdWJ0eXBlL1RydWVUeXBlL05hbWUv RjMvQmFzZUZvbnQvQUJDREVFK0NhbGlicmksQm9sZC9FbmNvZGluZy9XaW5BbnNpRW5jb2Rp bmcvRm9udERlc2NyaXB0b3IgMTQgMCBSL0ZpcnN0Q2hhciAzMi9MYXN0Q2hhciAxMTYvV2lk dGhzIDgxIDAgUj4+DQplbmRvYmoNCjE0IDAgb2JqDQo8PC9UeXBlL0ZvbnREZXNjcmlwdG9y L0ZvbnROYW1lL0FCQ0RFRStDYWxpYnJpLEJvbGQvRmxhZ3MgMzIvSXRhbGljQW5nbGUgMC9B c2NlbnQgNzUwL0Rlc2NlbnQgLTI1MC9DYXBIZWlnaHQgNzUwL0F2Z1dpZHRoIDUzNi9NYXhX aWR0aCAxNzU5L0ZvbnRXZWlnaHQgNzAwL1hIZWlnaHQgMjUwL1N0ZW1WIDUzL0ZvbnRCQm94 WyAtNTE5IC0yNTAgMTI0MCA3NTBdIC9Gb250RmlsZTIgODIgMCBSPj4NCmVuZG9iag0KMTUg MCBvYmoNCjw8L1R5cGUvRm9udC9TdWJ0eXBlL1RydWVUeXBlL05hbWUvRjQvQmFzZUZvbnQv QUJDREVFK0NhbGlicmksSXRhbGljL0VuY29kaW5nL1dpbkFuc2lFbmNvZGluZy9Gb250RGVz Y3JpcHRvciAxNiAwIFIvRmlyc3RDaGFyIDMyL0xhc3RDaGFyIDEyMC9XaWR0aHMgODMgMCBS Pj4NCmVuZG9iag0KMTYgMCBvYmoNCjw8L1R5cGUvRm9udERlc2NyaXB0b3IvRm9udE5hbWUv QUJDREVFK0NhbGlicmksSXRhbGljL0ZsYWdzIDMyL0l0YWxpY0FuZ2xlIC0xMS9Bc2NlbnQg NzUwL0Rlc2NlbnQgLTI1MC9DYXBIZWlnaHQgNzUwL0F2Z1dpZHRoIDUyMS9NYXhXaWR0aCAx OTg0L0ZvbnRXZWlnaHQgNDAwL1hIZWlnaHQgMjUwL1N0ZW1WIDUyL0ZvbnRCQm94WyAtNzI1 IC0yNTAgMTI2MCA3NTBdIC9Gb250RmlsZTIgODQgMCBSPj4NCmVuZG9iag0KMTcgMCBvYmoN Cjw8L1R5cGUvRm9udC9TdWJ0eXBlL1RydWVUeXBlL05hbWUvRjUvQmFzZUZvbnQvQUJDREVF K0NhbGlicmkvRW5jb2RpbmcvV2luQW5zaUVuY29kaW5nL0ZvbnREZXNjcmlwdG9yIDE4IDAg Ui9GaXJzdENoYXIgMzIvTGFzdENoYXIgMTIxL1dpZHRocyA4OCAwIFI+Pg0KZW5kb2JqDQox OCAwIG9iag0KPDwvVHlwZS9Gb250RGVzY3JpcHRvci9Gb250TmFtZS9BQkNERUUrQ2FsaWJy aS9GbGFncyAzMi9JdGFsaWNBbmdsZSAwL0FzY2VudCA3NTAvRGVzY2VudCAtMjUwL0NhcEhl aWdodCA3NTAvQXZnV2lkdGggNTIxL01heFdpZHRoIDE3NDMvRm9udFdlaWdodCA0MDAvWEhl aWdodCAyNTAvU3RlbVYgNTIvRm9udEJCb3hbIC01MDMgLTI1MCAxMjQwIDc1MF0gL0ZvbnRG aWxlMiA4NiAwIFI+Pg0KZW5kb2JqDQoxOSAwIG9iag0KPDwvVHlwZS9Gb250L1N1YnR5cGUv VHlwZTAvQmFzZUZvbnQvQUJDREVFK0NhbGlicmkvRW5jb2RpbmcvSWRlbnRpdHktSC9EZXNj ZW5kYW50Rm9udHMgMjAgMCBSL1RvVW5pY29kZSA4NSAwIFI+Pg0KZW5kb2JqDQoyMCAwIG9i ag0KWyAyMSAwIFJdIA0KZW5kb2JqDQoyMSAwIG9iag0KPDwvQmFzZUZvbnQvQUJDREVFK0Nh bGlicmkvU3VidHlwZS9DSURGb250VHlwZTIvVHlwZS9Gb250L0NJRFRvR0lETWFwL0lkZW50 aXR5L0RXIDEwMDAvQ0lEU3lzdGVtSW5mbyAyMiAwIFIvRm9udERlc2NyaXB0b3IgMjMgMCBS L1cgODcgMCBSPj4NCmVuZG9iag0KMjIgMCBvYmoNCjw8L09yZGVyaW5nKElkZW50aXR5KSAv UmVnaXN0cnkoQWRvYmUpIC9TdXBwbGVtZW50IDA+Pg0KZW5kb2JqDQoyMyAwIG9iag0KPDwv VHlwZS9Gb250RGVzY3JpcHRvci9Gb250TmFtZS9BQkNERUUrQ2FsaWJyaS9GbGFncyAzMi9J dGFsaWNBbmdsZSAwL0FzY2VudCA3NTAvRGVzY2VudCAtMjUwL0NhcEhlaWdodCA3NTAvQXZn V2lkdGggNTIxL01heFdpZHRoIDE3NDMvRm9udFdlaWdodCA0MDAvWEhlaWdodCAyNTAvU3Rl bVYgNTIvRm9udEJCb3hbIC01MDMgLTI1MCAxMjQwIDc1MF0gL0ZvbnRGaWxlMiA4NiAwIFI+ Pg0KZW5kb2JqDQoyNCAwIG9iag0KPDwvVHlwZS9QYWdlL1BhcmVudCAyIDAgUi9SZXNvdXJj ZXM8PC9YT2JqZWN0PDwvSW1hZ2UyNiAyNiAwIFIvSW1hZ2UyNyAyNyAwIFIvTWV0YTI4IDI4 IDAgUj4+L0V4dEdTdGF0ZTw8L0dTNiA2IDAgUj4+L0ZvbnQ8PC9GMSA5IDAgUi9GNSAxNyAw IFI+Pi9Qcm9jU2V0Wy9QREYvVGV4dC9JbWFnZUIvSW1hZ2VDL0ltYWdlSV0gPj4vTWVkaWFC b3hbIDAgMCA2MTIgNzkyXSAvQ29udGVudHMgMjUgMCBSL0dyb3VwPDwvVHlwZS9Hcm91cC9T L1RyYW5zcGFyZW5jeS9DUy9EZXZpY2VSR0I+Pi9UYWJzL1MvU3RydWN0UGFyZW50cyAxPj4N CmVuZG9iag0KMjUgMCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggODg1Pj4N CnN0cmVhbQ0KeJyVVl1v0zAUfa/U/+AnlCDqxIljJxJC2gegIU0aWiUeJh5C65VA04zEFeq/ 597rfLW0pWxS5sTX555z7rVnFjywt2+D+5u7Wxa+e8eub29Y8PFRsVUznfyaToSIeZSyEH5h lCimIxbBIGKLcjoJ7sp8ZSLFbiv2eTph7+9vGBshihYRgKQDiRSXLJHwTBFHjmH0GCa4qm3x nC8sgl1Zmy++myV7Cq4ra6vyazDfvZjgIV8Vm9wW1SZ43H6z+OlDVVlTt3mv5wD+QTARsfkz iHE6QAMPI8nilGehZHNgELIVPj5OJ08e87+y+afp5P2cHDimK9rDT07g6zDliuCfvHt/Jr0d s/4s8Uzua69k+OW3n3jFeg3j2HuBcW38WQQjmMr9rH2lWXxlvvLKCt+6CeUtMdYArvLyAmLW ZunHbokLal4gqtr4M+01hkBgykKuiuEiHH0nDIbciqbxReRt6UtDHHfVFmJoWQXEacriY134 IvQ2FNonLeidhrsK5ym+JqQ1vhtrDbHjrBd3hznbhcqBO05+ulcO9PvAZJXFPJOtyy45rTc1 ohPD8g1lb+3whXARztam2UJKN7fsdPamoOtD8NUcn6/mnYs/qBaDCw0pGvmVb3zpKrRnSNL6 0VgKeoagZxd0XGosJc+SA6l91mOWASyKMU1Rk9l9DBQ99r6RHdgtBLAi2oeN0OMj0HagW+/+ VRGd8bhl6XKuzJ6pUBp9UqsQmsOB8jcIraFtguSBe2Wxp81iv6AL0Nd2O04Q8RKbIcbyaGd0 TYUruzpiRTbddoSagXzbebkcIQuALmnlFmNoSYEJ+zYpkOaoF8YNMFTguHIZCR5ne8pRJhVi YNFvQddCJLfs1NDEUVqDI/+qnpJcdafWZjhc0JqKbPwJI6eu6vw8aEE4Z/T/OJt3ndg79dL3 yaCmgH01iGhLna/XDT+5b4TiUbIvaRz717kej871Q1+SEP5eAiLPgMQJj9MW5LEgP1CFO6zM evfm5K7IeKj2158lkRwhEaUZlxlLUjhNLgJRp5UkGv55X+SpPgOSpDy9yNP0DAgcjuIiOdkZ kCjjibgERIRnUITkqb4IRZxBCUMuLuMSHbmxzaBP8SfR2tU6TZmCC4rUeJGrzXTy5TXbTCcx ZQ25SpTSTNPlrg2nO9m9sTkscFeyPgFx+AMlgDOwDQplbmRzdHJlYW0NCmVuZG9iag0KMjYg MCBvYmoNCjw8L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDMxNC9IZWlnaHQg MzcvQ29sb3JTcGFjZS9EZXZpY2VSR0IvQml0c1BlckNvbXBvbmVudCA4L0ludGVycG9sYXRl IGZhbHNlL0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggNTM4ND4+DQpzdHJlYW0NCnic7Z15 dFz1dcf/iIvjEIwToIQkLoFgGgdoCTlgoLQUQkOAAg2hUJZQCmEpkJQlLKFpwhoIBdpAUsuW bdmyZQvbkjd5N94tG8uLkG3NjGaTZtfMSDMjaTbNaKaf9/tpnp80b0ZC4OTY593zjs7T0+/9 lnvv9y6/5Smf/7SUzeW010Duk701yvIGGWSQSrv88VvWuLhq2qLyiau3/9a1ypPHtvtyJTC1 0tnz7UW2qZrr5tWu7lS2fFvuvv6Lau2y/NO7Ap/tQAwy6ISnpfbY56a3cv16b1A+ae1OjatQ nlxQa9P1gB96+k6eaZJvaS8waI2ly7Q13xJVC0+ubktmDf9qkEGfgMaA1ml1TvnKxErzpFnK 9cXKQfD+Yk9nmbbu3ejRovtgKHksRmSQQScqjQGtlyxxyFfWu3oJbrmqTJER0UpV+FMtWl9p Ch6jQRlk0AlJnwat7zaH6x09XFXmyGv7Qh91Jrx9mVIN7QsmT6pQXPB3FtvHi/qvW9lhzDUZ ZNDo6dOgddj16DZfunQq+tbBsCxW0xb95gIrNxNmmMLJESamDDLIIJXGgNZ5lugEvVkmrnea w6Uaunp5OwXGzzAF4pkntvtl+VXOnmM0LoMMOvFoDGiFlthieFL1uqGhQ1Zy6xqXbvloemBi pVnOG2/1xl9qCsry/77Nd4zGZZBBJx6NAa2evowjluZS/7jS2VMerXX2Hl1ffMEie7+Ruxpk 0OhIRev1qzqIY7me3905bno5tF5e7zx5pokLXFujaa4ZR7rLo/WpXQFdtNKQJVpuidYggwxS SUWrjuMbaZaJJFReJ1W0lkfreTXKtNKps8w/XOv+0TrlunTpYCXvt3Qd2xEaZNCJQsls7h9X u4qhetbctpZwSveVeeaoTEKHXXjble06s0Z4z8/PUGalbl7jUtF/pDslH9602mWEwgYZNEpK Z3PPNgbu/9CrvYhyy7yyzRu/f7N32Cv7gvp7k3b44rLAMscQLD/b2MlDAu+MkboaZNDoKJfL k3u+eSD0rx96b2xwPbTF9/tD3a7e/jKvpAdyW73xF/d03rbWzSsv7O5saO+NZwbKvBJKZqtM kUe3+Sh/7ybP6/tDGAQDpgYZNHoKJjJ3b/RMEEEpeeUZVRa5Y/+USjMYTGR04LTR3TdNZJ1k rF+abT5tjmW8eP0vF9rq7D3FL/QP5N5pDlNSRstnzLHQ0LjprUTCt69z28seBDDIIIMk2aLp c8W2oivrnYttMfxpLJ21RNJzTJGpi2w8v2qZc9g5uGqxNeILM02PbfPvDiT88Uw4mW0OJwlo J80yA9uKI91awKayOVw2VdHQey1dpu5UNJ119/bji29Z4xpfYfqL6jZe/yMP3CCDji8iXb1k sf2kitY3DoSKM8fe/oEHNiso+/Emj/q3vZ0JcPqVuRbC4OIKyVuBHoBdqdmh9IxYu7l2RTt+ elj5TC73h0PduHWccqDorwYZZJBK/3dYWST9t83eUgVwi1cvU7YLqti8bKkDb7jZ01fqlQOh 5MRZ5otq7fLsKpnpyZWmC2vtkVTJlPZXe4NExUTdn2IoBhl0gtMlix1kkZ7Sp2ag7b74uIpW QlnuD4aSf1bRettaV6kPSkh6YodfHKZTEE14zP1cc6RM+Vh64OvVbWdXW0c8nJ7N5Q51pfDg 8nL29H/mc1TtPf0v7unsSevYlnhmAA7Qbks4lTreztGvc/XetcHz4GYvIVOZYlu9fe80j3H5 G+nAGXfvUXVCsrCrr6hFmCwlSBo1mprJxWR5pK89NrInkHh9X2hsvS1P0fQAbY2mJGmgqpDq FUl/xmdVIqksOLqxQX8zg0oEyAS35y2w7vQn/nOPAr2ZR7rLvwJO8ZUPbPY1+hMXf2DHIMRG 6vxPtvio+fBI/HH2pCdWmk6fY/nGfOvX57WdOstMrP7Zblzc6Y/TE1+RBcMyXLpUMW40TfCA oWs7frZggZpzF1hvbOiYfrh72Lw9dumeTZ555sGP/LyxP0RWMrZWouksqvJs49EYCRMBM8GU +gRZvdQUQnBnzbWQT502x/KrveXOOOeUxf0IspZCP222mTjtw0JoR3B4ZpVlbL0tTy83BU+Z hSMrtywiqVrzORT1WvlZn1U50p0Sm+r9ZcoEE5lX9ym81fbkmhXtW0pHws3hJDZ8XMXR8qdU mp/c6S9z7hV6Wxym04pVl+yxNHh5v6UbB4EGzjFFyJG1a7h4Z3dfv3T93AMxXS+pS67efuxk KbT+em8QxcBs0nRHb//r+0MxTc0p0VaiaAGLzvj03AeVUH7YXAF5PX0YyOk8zBZFM+mBXCmW UgWVRzRzg6Fk9qy5bbXWWHFhhvzVeW2//GgQMipaqbx4ngE8UnOpQ5GjQWswkZ002/z4dj+F uZDdwsLXwHRpg6tvwgzTT3f46Qy8wSn/YFXHGVUWOfZRorVHiEy9by/iPBSIZ7SSgmPkdGqp nLI3vj+kd7ozkckRIbh7+6fUWO9Y7+GeS4Ze9Jm2hpVPC1Updr59QiW091o3RP/h5G1r3aXG uMMXnyK2C3KdMcfy9K7A91a0qxsOn2vsLI4GkbX6vaZpSx3P7Ap8de7gxyK42eDqLdXWs42B 0aN15pGI/JXRnK50TDE45y+03b7ejbZcsMiG+8DI/HmV5YuVJn7SDSkd0I1PjIvADAhgqxkj 9/j0K+udWBXs0vWrOnTR+sKeTnxB8Rr0xR84blvnPme+lba+Nq9tsW0QEcSEf7tMqXNipfm7 Sxy7xdACicyUGtvdGz1nir7RgdXtCk9QletWttM65b+5wLrJrRhDzOnVy53y4XcW22VXoSvq HHdt9MDPy5Y6iln0+0PdoI/KcVsPbvah4eFU9lsLraQwVMW72sK2aJpi/InyUxba0C4kSM03 rXZNFNz4/qoOaZSQNQqAGnylyoKbXtehI8rRoNUbz6A8o5+jQD+nLrIls0fNIGpMb3+zXwmA VbS+dTAM32RXMWxw+B9WdiQzOTivcvtv6p20K++xSPIrQ3uDycnVbf+ywUO8xJB5yyswW9MW RTqyRUU96gbV46plzha9CBAFo58yYYSCyewd692Up3L6YI8pamOOpO/c4IHhdOBLs83PC0ah mFfWKyqEdvEcQb/bHJb35yyw7tawjp4jWd0UjC5hAzFrD23xEdbe1NCRE8us3F9V77yo1s7N z3b6tSYKQSN39PYaAWqZqz4uzrGSLjFYrm0+nZnkvJi8gl09ZVOqfBFaMVynVJr+92MlzwKV JL/YamCyxBb7wkzTjCPdVAgcvjzb8oYQLnEgmibTKN6FmXK67IYG17cX2agcJqMeumjFq2IZ zp5v/a+PgtpdXsgU0e8PJqOpgZ9u91MnNePWSQH+bpkTOPDrrWtcsCWaymK9qYRYrqkzQSDN qClDJa/tCyFWcyRFurTC2YMDQvr8iUpM3Sngdu8mDwOUxp+uYkWXO3uKE4et3vjnZ5iojXq2 eePg7j92KpaK57SLhg/LxegnlgFX9eAWH9qLMYdRJ1W0vrQ3iF2qNkdBVp1dsT+oED2Et8D/ NwLRxY5mNGhF1+7d5KXaHzR0LLXHiqMRLSGpc2usT2wfEv5lcjn4dtPqjrwGrYfFLtaloqvY nEmzzP/zcRde77wa67cW2vZ2JgiZACMBBjegBmhj2yncGEjQQ5ogNf44nDy7uu1RcYQTw44o 8yKJQMTYcLybpy8Db3X3+GnRCibg59SFNkSM47hno+fyOkXKKMPPGwOIgHG919I1vkJRMxB0 Qa0NeKKKxKVI+cuzzQgXozStznH18na1iafF2sofDunkoWCcPyGpx7b5BPSUcAVcT57Xhln4 qDMhC6wq7ApuCiYRAUygRZqGXZ0JRZrksECYjImQBn4i8WhRaArElMmrde4R80+JVpT/labQ UzsDwARr7xb+jmESL8lid653X17nyBSixx9v8n53iXIuTxet6BiV/PfBwUP0O0pEwpA1msZ2 MTR6+8hWn5wTQ5SIRhZgbFgPhoPmo/PbC6YJATF2cCHRio7J5y/u6TxvgRX9x+BQ7fstXeqs C8jF4CwqxK6ytzK7BK2vlJhagQP4bnWy7pnGznPEeD9RJAzi5ExUVypLwvjmgRBxOOJ+Uhhn Lr8Yxdoi9zoatOZFKFjZGsHjkC5h/coEVHSD/v9sx/BkDXdw7QpFjVW0ImvCACwA97gJLL+7 NyPR+paQLLrw98vbH946KKkndwWuEnYStMJn9UOd2FuGkNegtd4eG19hOjDS5/60aCVJwdNV HumW7EL6KIOzR2mCX7d44nT78e0+tMgk9vKBVpVp2JAfFsLdl5qCF31gV5vAVqCo9LZxKMfk YdWHtnixAPhQrFOiEIpUiJNxjHSXXzHjRBfSvf7zejcl8Qs3iwMCr2nUSbraNw6E5Pzw9MND jANW8Uyxe6qla+QNEhKtV9Q579vk5UJp1X1QoFUV6zXL2x/aevSQO6NWQJoZ0EUrNpMbdeqs VN6qEjpJQAX/5dEhLVrhJ4bx7ebwModyrElNQ0iyiH8a2nslWlUTB1oJngEFXcJyYgZhKREU rWP0qMESGRwdITQDlFwFra+WQOudG9xIRP11QVsU3uJrxpC35gtopZPd4gZrTHimXgssw2sb JVpV4vn5Nbbza6ylNqyCVuT18JYh3yuQvlWqtDZvrbUqJ02QJmH8HRs8eZFRgtb3Cie8gPMj Ba14aihabQUtmt0amSRAqqK1yqRgf0Q/okUrTo1RT5h5lFenzjJZoil8K+6MzqOQxKVatKp4 AUd3ic7ni9CaF8flkAI1//ZAGJlKd/SQmKEFZQAQFRrm+u8WXxm9sNaGYeRGTIzkJ4kti5eJ 7Yj/tNal3a8IoFAAnn9/ZYfws8qJm5yYlidcQXtPqlCi1pH4MViVNhLWkhatiPKqghmBiMP/ 6gN7SvhWwCUdh7OAVnSSPshwGiJW10WrNuZnwAQJ0iBQ4QObB3WAEAvRLLHH9gUTsE41yK3d aVQCZ1QKrfJXpIxfnqwofICkFbnIVbC8yLKxA7NalYGXQesj23yYVnV24hd7Os+uVrK5T4lW KvzrD+zPjZRsorEXL3bcs/Ho8j06T7BhG7qzVDth9jsRVJTZkf6jdW40PKHJW4k6ivPWvFhf I92AdYh1vZghGT1a1el9Araz5lryGrTCNPJBc2SE+f8hvjWbO7nSNK9o1ZJ4G21JC+kQdY8B rXkRrH5D4A7TRLRAoo1GyakhZHS4KEpHds/tDpxc+IAwng57Lk+v4xoeLoSIWsKREYHLM7Bk r9et7MAUgC9+hdvVlugo12BGidYqUxQlQWT4LDJE+C+nNYgkaZHsGwV++2AYdsm8lb5hZ/BB PP/JFq8uWlHjl5uCDASwkxfTDZlBwDpUAoXkOW5F6h7tgpr7PvRikXrSA0/uVGbbwEUptO7w xbd4+8iyKU+IKD9GR/B5Q0MHOWxPoWap9mXQ2tDeg1wIBekMWg3u5NaXMmhV/GZ12+Pb/eTs aI4uWrlnCOR06BhDc8TScFJXZCgk8sXmUG1zKElXGQ6azFuYmj2dCRh4+zo3OQKsJqImHzxf hO47fXHC/uIZFPwvFZK2S84TVVIhqJTz1aD19DlmQhf54nONnXJfnHQWo0Qr4lZW2MVcMTXf JxCnohX+y4VCOsyFrjqLpnnzQ9EKG29Z4wIXdJKBk0AtEXOPmHcCCWwygMU7oH4t4eQnRauU 5jvNXfijr4m0FFjhbQl6i9e1VWrpSoFreRBALvGA2VKTSHI4xMkAh07SBLntJUscbx4Ij3J9 XBLBPzXMNenM+WOBn2sMqG0hl9OUFTplnY6MOCYGwjAZPiYFJWSw/JSpJU4QVhMbkCUp063z 2op7hV9G94AMwR79J8CQM5CglWtKjZXnuL/3Dw3qBnaAOqmK54Rzy8Uykz+RQR/WFubGX2kK AmoRY4QZF3CgMFW1iF3Tjf7EBYtsdHKy2Doip1DyYkburYP6n6pDafGnDJl6+ElyJ1c6MBSA os6uvwhIbMC4GDvx9rvNYeAgn9OxqQtt8pvPkdTAnRs8CovmW+kqLk93chJzhB0GX7ACFbqo 1k7GlFcy9yRsv3ejB4ODOBAN5ovkjtrkSgGwxd7qbtQhLzt/oQ1/yqD4yaDUpGlNRy9VobRy geZwl7Io+cuPBmOAZEaxeBWFsI2Ii9Rb3sOl60WSC1qJYa5e1k5PqGraUodDmMQFluhkkcBC S+xKwCNFCRv3duoE9qjcpUsdjxY+MgbwqQoLSbX4IzlRhpoh4gtr7QCZ+BMI1LRFQeu0Ooc6 bQLeHyjsLSR5vKLeqSsySZgjOHbrGiX31F0o1NL9Yq8+TuGwmEUhxy+/xwnsoxWXLnHgfaJj 2uxBzoL69emlOfR2WJ1wDMbaNR+PUvqQUXbXkBWibOq6mPocfwTbqUp3RRF/R1KwVzgIdaQy b+UVnruHRnTEZvtDyYOhpLp9iGopqcYe0r/IuLVLLPBRWDsxnsgMtISVvVvaoWGxy0+eI0E6 Y4qk1JBYTg3pHqfKC01ziwlP+kXN6oZt+Za6rDwgjlVSs0PPuahENgXPKQav0oUO5MRki7oE HBDs2h9MqqKk0TLRJmI6IjhPB7RLzznxok/pufKwzq6sBTBw7V9Vj4PJUjtANXJOW0bCdPXj cIpgQNUHxKLVf8pL6ZTZbkdb2vMvMN8k+qxdFoeZPJExkmqatAIlnlEr4WHxkncx/a6lCxiq qZwuMXCMIR5NatuV9U5ttq5LRGjjFNN3Qn2fXzvLZNCfijBrtlj/5XXO761oH7m0hobNMh2P BBJx04DRWmJzHQiV+d3LhX+NUWVSkEi4XmqjC1aaMECb0Z8YRFxq/LO8Pznt8MdJx86eb9UN U8sQcQt5im4qehyR9INkXsXDx449ts3PX4lp1RgPvy8/7kR4HCn6v5Cg/pLFynTxq/tCx9lu +JGIGKn8FzMM+iMQAaoj1j/iPyQtJvwO6nq8f8CE/r+yLzhBLLE9stW3ytlDrrfdF3+7OTxV LMeAPltsiEWCV9eKpVWMFT53qzfeFEyu7uglxZZfjXjB+P6SQQYdGwJY61y9VxT++aP8PqFc 6Pl5Y0DXjmHifnswrP4jOfk/qj4n9lfU23sMpBpk0DElvOHH4eTMI5Hnd3e+ti/U0N474v+Z ArNrO3rlV8SnH+7eHUgcd6dBDTLIIIMMMmgM9P8F18dwDQplbmRzdHJlYW0NCmVuZG9iag0K MjcgMCBvYmoNCjw8L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDcxL0hlaWdo dCAzOS9Db2xvclNwYWNlL0RldmljZVJHQi9CaXRzUGVyQ29tcG9uZW50IDgvRmlsdGVyL0RD VERlY29kZS9JbnRlcnBvbGF0ZSB0cnVlL0xlbmd0aCA4NDQ5Pj4NCnN0cmVhbQ0K/9j/4AAQ SkZJRgABAQEAYABgAAD/4REERXhpZgAATU0AKgAAAAgABAE7AAIAAAATAAAISodpAAQAAAAB AAAIXpydAAEAAAAmAAAQ1uocAAcAAAgMAAAAPgAAAAAc6gAAAAgAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEhFUk5BTkRFWiwgQ0lO RFkgUwAAAAWQAwACAAAAFAAAEKyQBAACAAAAFAAAEMCSkQACAAAAAzY3AACSkgACAAAAAzY3 AADqHAAHAAAIDAAACKAAAAAAHOoAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyMDE2OjA0OjE0IDEyOjM1OjUxADIwMTY6MDQ6 MTQgMTI6MzU6NTEAAABIAEUAUgBOAEEATgBEAEUAWgAsACAAQwBJAE4ARABZACAAUwAAAP/h CyVodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvADw/eHBhY2tldCBiZWdpbj0n77u/JyBp ZD0nVzVNME1wQ2VoaUh6cmVTek5UY3prYzlkJz8+DQo8eDp4bXBtZXRhIHhtbG5zOng9ImFk b2JlOm5zOm1ldGEvIj48cmRmOlJERiB4bWxuczpyZGY9Imh0dHA6Ly93d3cudzMub3JnLzE5 OTkvMDIvMjItcmRmLXN5bnRheC1ucyMiPjxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSJ1 dWlkOmZhZjViZGQ1LWJhM2QtMTFkYS1hZDMxLWQzM2Q3NTE4MmYxYiIgeG1sbnM6ZGM9Imh0 dHA6Ly9wdXJsLm9yZy9kYy9lbGVtZW50cy8xLjEvIi8+PHJkZjpEZXNjcmlwdGlvbiByZGY6 YWJvdXQ9InV1aWQ6ZmFmNWJkZDUtYmEzZC0xMWRhLWFkMzEtZDMzZDc1MTgyZjFiIiB4bWxu czp4bXA9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC8iPjx4bXA6Q3JlYXRlRGF0ZT4y MDE2LTA0LTE0VDEyOjM1OjUxLjY2NTwveG1wOkNyZWF0ZURhdGU+PC9yZGY6RGVzY3JpcHRp b24+PHJkZjpEZXNjcmlwdGlvbiByZGY6YWJvdXQ9InV1aWQ6ZmFmNWJkZDUtYmEzZC0xMWRh LWFkMzEtZDMzZDc1MTgyZjFiIiB4bWxuczpkYz0iaHR0cDovL3B1cmwub3JnL2RjL2VsZW1l bnRzLzEuMS8iPjxkYzpjcmVhdG9yPjxyZGY6U2VxIHhtbG5zOnJkZj0iaHR0cDovL3d3dy53 My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI+PHJkZjpsaT5IRVJOQU5ERVosIENJ TkRZIFM8L3JkZjpsaT48L3JkZjpTZXE+DQoJCQk8L2RjOmNyZWF0b3I+PC9yZGY6RGVzY3Jp cHRpb24+PC9yZGY6UkRGPjwveDp4bXBtZXRhPg0KICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAK ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAg ICAgICAgICAgICAgICAgICAgICAgICAgICA8P3hwYWNrZXQgZW5kPSd3Jz8+/9sAQwAIBgYH BgUIBwcHCQkICgwUDQwLCwwZEhMPFB0aHx4dGhwcICQuJyAiLCMcHCg3KSwwMTQ0NB8nOT04 MjwuMzQy/9sAQwEJCQkMCwwYDQ0YMiEcITIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIy MjIyMjIyMjIyMjIyMjIyMjIyMjIy/8AAEQgAJwBHAwEiAAIRAQMRAf/EAB8AAAEFAQEBAQEB AAAAAAAAAAABAgMEBQYHCAkKC//EALUQAAIBAwMCBAMFBQQEAAABfQECAwAEEQUSITFBBhNR YQcicRQygZGhCCNCscEVUtHwJDNicoIJChYXGBkaJSYnKCkqNDU2Nzg5OkNERUZHSElKU1RV VldYWVpjZGVmZ2hpanN0dXZ3eHl6g4SFhoeIiYqSk5SVlpeYmZqio6Slpqeoqaqys7S1tre4 ubrCw8TFxsfIycrS09TV1tfY2drh4uPk5ebn6Onq8fLz9PX29/j5+v/EAB8BAAMBAQEBAQEB AQEAAAAAAAABAgMEBQYHCAkKC//EALURAAIBAgQEAwQHBQQEAAECdwABAgMRBAUhMQYSQVEH YXETIjKBCBRCkaGxwQkjM1LwFWJy0QoWJDThJfEXGBkaJicoKSo1Njc4OTpDREVGR0hJSlNU VVZXWFlaY2RlZmdoaWpzdHV2d3h5eoKDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2 t7i5usLDxMXGx8jJytLT1NXW19jZ2uLj5OXm5+jp6vLz9PX29/j5+v/aAAwDAQACEQMRAD8A 9/ooqGeZLe3kmlbbHGpZmPYAZJoAmorzLwV8XoPGOv3GlrpLWjLC8ts7XG/7QFOOBtGOh7no aydT+MniPRntk1H4d3Vs11J5UHmX+PMbsB+768igD2OivNH+Juqad4e1PWPEPg+70lLXYsEc lwGNw7kgKDtXbjqTzxUnh74m3eo+KLTQNZ8OSaTdXtt9otT9pEwkXBbnCrt4B9elAHo9FeRa 18XvEegAyah8PbqK3MvlRzPfYDtkgY/dnriur8IeK9f8Q3c8Wq+EbnQ4kjDxyzT+YJCT0A2r jjmgDsqKQHNFAC1598ZPEB0L4fXaQti6v2FpCB1Jb72P+Ag16DXL+I/BsHiTXdD1K5upFj0q V5VtgoKys23BbPpj9TQB4Td+JtG0WfwVfaRb38UmjKLe8aa2aNZEY5Y7u/Jc4969A+M8izXP geSMhkfVkKkHIIJXFeheKPDlr4p8O3ej3RKR3C48xQCUIOQRXPah8N49S0bw1p9zqtw50KVJ I5jGMzBcYVhnjhQM0AZHxjvpLzT9O8H21kk95rc4SN5GIWHawO7jHOf0z1rzmxvL34beJ7oa /Yz6r4lWJLfR5pZC0BQnadvccHH5jjJz7V418CWfjOG0d7qexvrOTzLa6gPzRnOen4Zz1Brm 7j4LWmrvc3Ov6/qWqX0kYSC5lIU2+DkFQDg/TpQBD8Ymun8A6Q16sa3Rv7czLHnaH7gZ7V6t D/qI/wDdH8q4vVPAD634R0/QdR1m4meznSUXbRjc4UnAYZ9OM12sa7EVfQYoAfRRRQAUUUUA FFFFABRRRQAUUUUAFFFFAH//2Q0KZW5kc3RyZWFtDQplbmRvYmoNCjI4IDAgb2JqDQo8PC9U eXBlL1hPYmplY3QvU3VidHlwZS9Gb3JtL1Jlc291cmNlczw8L1hPYmplY3Q8PC9JbWFnZTI5 IDI5IDAgUj4+Pj4vQkJveFsgMCAwIDU3MS40NiAxMjQuNzNdIC9NYXRyaXhbIDAuMTI1OTkg MCAwIDAuNTc3MjYgMCAwXSAvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA2Mj4+DQpzdHJl YW0NCnicK+TlKgSjQDACMkzNDfSMjRUMgNDQyETP3AjE1DMwMDIzMzJXSM7l5dL3zE1MTzWy VHDJV4BoAwDG/A2LDQplbmRzdHJlYW0NCmVuZG9iag0KMjkgMCBvYmoNCjw8L1R5cGUvWE9i amVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDU5OC9IZWlnaHQgMTMxL0NvbG9yU3BhY2UvRGV2 aWNlUkdCL0JpdHNQZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0ZSBmYWxzZS9GaWx0ZXIvRmxh dGVEZWNvZGUvTGVuZ3RoIDIzNzU0Pj4NCnN0cmVhbQ0KeJzsXXlcTfn7z9gZKrSgHUmWlDII hWQ3lpLEmF/GbiJjN18GGRMayk401rGmQSNlZyxlKUrISCItGkKYQd/f+3ufV5/XmXNvddvu udXn/cd93W7nfM5zPp/ned7P81lzcjg4ODg4ODg4ODg4ODg4ODg4ODg4ODg4ODg4ODg4ODg4 ODg4ODg4ODg4ODg4ODg4ODg4ODg4ODg4ODg4KgTev3//+vXrN2/eZMmQmZmZlpZ2//79vXv3 bv83Tp06FR8fjwtevnz5zz//SC04BwcHBwdH4ZCSkvLq1avQ0NAfZfDw8LC1tbWzs2vatGmT Jk00lEDjxo3Hjh3r6+sr9atwcHBwcHCIkZqaijwuJiYmLCzsdxm8vLxGjRplbGzcsGFDAwOD zz//XBmyyweVKlVCacuWLXv69KnUr8vBwaEAH2T4+++/8fn+/fuXL19mZ2fjT3zJyMh4JkN6 ejp+ef78+YsXL+A3cNm7d+8+ffqEL1KLz8FRMKC9mZmZcXFxW7Zs8ff3Hzly5KBBgzp06GBh YWFoaAieKibTFYgffvhB6jrg4KjQSEpKOiNDSEiIn59fYGAgrHLt2rWHDx/+/vvvJ06c6O3t Dc9gY2MzcODAcePG2dra6uvrk/1qaWl5enoaGRm1adOmWrVqo0ePHjFixNy5c6dPn753794f ZNi3bx+I8tq1a1FRURTxZmVlwfNI/d4cFQL//TfoxydPnkDhN2zY8M033wwbNqy0aS4f1KlT R9r64eAo97h169bHjx+PHTsWEBCAWHfFihVjx451dXUdMGBAw4YNGzRoUEeGWrVqVa5cGUQG w6xSpUrt2rWLbNcop0aNGvQdX3R0dDRlwLPwRD09PVNTUzc3t7EyrF+/HkG41JXEUQ7x4cOH f/75B5/v3r07f/78ggULHB0dmc5XrVq1ZGisGOAMyMFRgvj06RP1UiKzu379Okx+8eLF3bt3 nzJlCgxfanPPE02aNAEjQ8ipU6eCECH58+fPX716RT2xUlcqR9kDiA+G8OjRowcPHiDXc3Fx 0dLSKr6iIj6smwtdXV1DQ0MHB4cJuVi+fPm+ffu2b9/+22+/2djYKFNg27Ztpa4qDo7ygIcP H8L6ZsyY0aVLF0tLy+Ibu4RABmplZdWrVy8vLy9/f39OghyFwpUrVyZNmoR0r0RYD3Bzc/OR ITAw8FwuHj9+nJcAaWlptra2BRbr7Ox89uxZVdYMB0f5APIjUN6BAwd8fX2RPZmYmGhqalav Xr2Ylo4QF+mYpQzgICLTPn36DFUOiIe//PLL9u3bW/4b5ubmOjo6RROpatWqkGTcuHFbtmyB Z8vOzpa67jnUESkpKWFhYbAIKHDR5moy5YcOjxw5csWKFQgpIyMj09PT3717VyhhTp06VadO HYVP0dbWRnq4ZMkSFMuVmYNDSbx9+zYzM/P06dMgGicnp06dOhU50atbty7MEJRkamraRIY5 c+aEy3DmzJn4+PgHMiQlJT1//hxf8GglhYSEyNfgix78G/fu3YuKikL5CKGb5MLMzExbBuUH HPX19UHKu3fvfvPmTanWNkdZwYsXLxAKwiKsra0LNXL92WefkSE0btwY2oickSl/8fscYmJi 7OzsUDi4GHko2BDfjY2Nwa2XL19OTk5Wshyaev3x40coPPLKjIyM1NRUWFliYmJCLpCK4l/P nj2D3eG/iI3pxk+fPhXzLTg4pMXr168RJd69e/fEiRMTJ04E6xWB75BDISnr2bPnvHnzfGVA qHzx4sXo6GhpJ2TCri/KcPjwYUjl6ekJIZVZVlyvXj2EAQizJRSeQ3LA7QcHB/fo0cPc3LxQ FoHQEZrm4eEBs4L6PXnypDTEQ9qIwo8ePQpiPX78OL5nZWUVeBcSwxMyIMwLDQ2dOXOms7Oz l5eXi4uLlZWVra1tixYt4AeEXI9QtnXr1s2bN2/WrFmrVq369++Pu2bPns2jRI6yCyi/u7s7 lFlPT69WrVrVq1dHyKqkgcMccO/q1at37dqFoBF2hyQO9gjGkfq18sM///wDIWG2CHoRQkP4 r776Cq+f12uiThwcHMDmUgvOoVIggVq/fv2gQYOQXtG8ZWWAJNHHxwfBJLQLOgZNU5P1OLBK xHLgu2nTppmZmXXs2LG6DAhcC2X1IuBGJJ7jx4/ns6w5ygRgj6mpqbdu3dq6devKlSuR5iij 5Nra2rS+AAY+Y8aM7du3nz17NjExUeq3KTEgUYW7w6t16NCBLUIUwsDAYN26dTzcrQhA0rdm zRp7e3tlKABxY+PGjfv27QvlOXnyJIhPavH/h1evXj1+/DglJQWf8+bNQyrapUsXWHGhGU5p 9OvX78KFC2pC9xwcChEZGenp6dmuXbuaNWsqqdidO3cGNSB6vHz5ckUI82DCCA/gzTQ1NUVV gVB52bJlUgvIUYoAcfj5+SkzuxLQ1dUFuezfv//OnTtqNRa2atWqgQMHmpqatm7durA9t8UB guSbN29K/fYcHP/CtWvXgmSws7MrcGUuUkIkQaNHj/by8tq5c+e9e/cqZlD38ePHFy9e7Nix o1u3blWqVGH1Y2xsvGnTJr5oovwhKysrPDzcwcGhwP7AFi1a9O7d+8CBAwcPHqSF8IC0DAjh z549O378eBcXF9hvkbs0EeNZCdCjR4/Bgwd/+eWXwh/NzMyMjIyaNGmi0JmAee/fvy9hVRQZ ohZUq5CGQyFE+y8JAdp69+4d+Mvf379x48YFan7Dhg1btmy5ePHi6OjoZ8+eqf5d1BbPnz+H HxCSIALd+Ph4qeXiKDGAv1JTU+fPn6+vr1+5cuW8bKRatWowEzBCXFxcZmYmu/2TDKUhmNDA P8ogf01sbOypU6esra3r16+vDMfhBXGlnp4ebTBI6N69+x8yREZGPhYAr/n27dvs7GzhjyA4 6H9CQsKRI0ecnJxAiELC1dbWPn36dGnURomAVSOrW9oKAy0In0mHSVGF40dcqdC7cqgJ8mLA 27dvf/311+7u7gWujIPyI2hct27dzZs3C7sQqeIAJLh582ZhZU6YMEFqoThKDBEREaCAfFb2 wcN7eHgEBgZev35dlYLlw4CvX7/OyMg4duyYkivxLSwskJ3B0mmh/dWrVxEel4iQycnJQ4YM ET7r+++/V9sECnVIsrG6xS/EgPgCugcJsnqmHyWVlyM/yNPf/v37GzVqVGAfSKtWrVxdXUNC Qpg+cBSI4OBgNjO8UqVKPj4+UkvEUVzA4+3ZsyevFeUaslkuc+bMKb0sL3/IMyCCW7CepaXl ZzLkf6KEjY0NiPv8+fN0b+m9gp+fn/C5M2bMUFuvIhSMEsD3798/ffoUsc3Dhw/ZiA8b5qiY Y0BlAhSf0OacCQkJ3t7e7dq109XVVdiNA0sxMTGBRSB5CQsLe/z4sfJrzzkIsJTvvvuOdYca Gxvzg5nKNKKjo0eOHJnXMgcjI6NJkybBMWZnZ0vVFUb0l5mZ+eTJk6SkJHCxoaFhXklfzZo1 W7du3adPnwULFoSHh0dFReEu1Tjw0aNHCyX59ttv1ZYBhVkDudA7d+4sXbrU2dl52rRpsbGx 5Bhpk/McARVyqBvQdvDAWVlZ0DdTU9O84kAEijo6OosWLYqPj6debo4iA3XI1tHXrVv32rVr UkvEUUTA+/Xq1Ssvk0EYidwQseW7d+/gA6ViQAgZFBTUrVs3xK5t27aFyikUGPEtBN6xY4cy C+FLA9bW1kJ5/P39JRFDGYhy6hcvXmzYsMHW1rZq1arIERYvXhwTEwO/Sl2juFJtqbyCA9Ed AlTEe46OjgqNolatWvb29pMnTw4ODuapSkkB6QDqnGr4888/P3PmjNQScRQFCAXnzp0rnN3E gDTq6NGjOTL2oVObJZkOkZiYuH79+iFDhiDpU2jgmpqabm5uo0aNmjVr1v79+x88eKBiCRkQ JwjXFCMV3bt3r1TCKAO0Jh3G/erVq9WrV1tYWID+IDYCifr16wcEBLx+/ZpN7uXjgGoFNEdC QsLUqVORieTVe6Orq+vu7o50Pj09XWp5yyFYhw+sZtOmTVKLw1FowLkhepSf96KlpeXl5aWy nkOCcKSPXO7du3dTUlK8vb0Vbj6PH5EMdurU6dKlS2/fvlWH4BYBg3BxsZ6e3o0bN6QWKk9Q JaPeUMmHDh2iLV7BfQiH8Im4AqEREn+qWD4RVK3w+++/z5w5s2nTpgpH+mDRTk5OW7duvXjx Iue+0sP8+fOpwmEyGzZskFocjkIDwaH8lrBwg2hNFQ/6MPqDWwYvw2wXLlxoYmLSvn17UeoH 5wyW8fT0/OGHH168eKFKIfNHdna2aCJoq1at1HnfJFrjkJaWhhS7R48edFQ3qhehBeWAixYt QmjBZllILS/H/5CRkXH8+HFjY2OFSR/iFsS0JTW3mSN/DBs2jOWAgYGBUovDUWiMGjVKZEH1 6tVDbKl6SYj+wH0XLlyIiYmZMGGCvHXDLXfo0AFaV0q7ahcHYIoTJ04IpQWhXLlyRWq58gPx WlxcHGq7YcOGNJ+WGBAxLfLr4OBgtjgirzWYHCoD4lUKC+vWrSuf+tnY2Pj6+j548IA3k2oA L9SuXTuWdPNxwDKHLVu2yB9s9Pvvv0sy6R3Z3Nq1a5FDIfWANwZ9CKVCxDt69Ojw8HDkhmqV 9zEkJCSIto9DVvXXX39JLVcBoHV/4O7evXtXkQGuFVSoq6s7d+7c5ORkIQPy2YOSAE2QlZV1 7tw55m+FqFmzpqGh4Z49e6CBUktasSCMeOGyUlNTpZaIoxCAQ5s6darQlKpVq4ZfVLwXBHV4 BgQEdO/eXX42TtWqVRs0aNCvX7+IiAg1P9Y2LCxMtJRy9uzZUguVH2hdJ81yQdjzxRdf0DRa SgORAKLO379/z8YK2ZoIDlUCOd2iRYsUznw2NzcfNmzYxYsXpZaxIgIJYM+ePVlbzJo1S2qJ OAqHpKQk0dZhnp6eqhQAVJuZmbl06VI4W3nrbtSokYeHx86dO9U/jULKjAhcNJxqYmLy6NEj qUXLDzS/F4HQ48ePvb29EWlUzkWNGjUmTJiA31l/GvWX8qFAFSMkJERfX19+y1lNTc2hQ4fS +lypZayIgDkgvmUd0Q4ODurZMcWRD+Lj44U2paOjc/ny5ZIq/L9yEP739evXsbGx48aNMzQ0 FB3L8tlnn4H7Ro4cGR0dXVb2qXj58qWVlZUodfX391dzvqAEEHHIL7/8Ym1tTfM/afmnhYXF 4cOHy0r9l0tERkYiv0NYIuI+MzOzMWPGnD59Wh1mPldMgP5WrFghHD9avHix1EJxFBpBQUFC y1q4cGEJFs6cvzwD3r59G+ErUiT5oXxLS8spU6ZERUWVod62J0+ezJs3T/Qibm5uGRkZUotW AIgBEYr07t0bSR9lf+BuLS0ttEJaWpqaM3h5xZs3by5evNi3b1+5fpH/dXsmJSVJLWBFR3Bw sPDMXOTjycnJUgvFUWi4u7sLjWvfvn0lWPinXLDvCFn37t179uxZBLHypo0cZP78+a9evSpB GVSDX3/9VfQuiNtB4lLLpRTS09P9/Pyo/xPchwSwWrVqnTp1CgsLQ3uVoTikPAFm0rBhQ1F8 aGhoCFpEWMXDEmlx+PBhUWI+atQofo5GWYRwGkyzZs1K9hQw4XZbSDTWrl07bNgwJBqiWdzw utCfuLg49R/sU4jMzMwWLVqIGBAerEzMmQTHhYeH0wQkmgCDL4hPfHx8kADyBYCqB2zQ29tb tPq1du3akydPRugotXQVHYjPt2/f3qpVK2HrIBm8c+eO1KJxFAVoTdaOaNbnz5+XYOGM/lJT Ux8/fiw/yRO5Bpytv79/Xmd6qj9evnw5ZswY4SwFkEj//v3LyuSEp0+fzp49u379+nSyBkhQ S0tr+PDhV65coUOR+NQXVQL5nXzPp46OzvHjx6UWjeN/xjJkyBD5vbPWr18vtWgcRURAQABr x65du8Kfl2z5Hz58ePv2rZOTU6NGjURq07Jly61bt5YVpsgLCxYsEL1XvXr1YmJipJYrT7At d2gN4J49e9q2bYtQhBYA1qxZs3PnzsgKkRviv7wLVGVAc1y8eNHU1FTU84n0XJ3VqYIA0eCW LVscHR1Fxyw2bdoUrcP7P8suZs2axVrT0tKyBHPAu3fv7t27d/DgwVZWVqKJ3H369Nm2bRuy wpJ6llRAZC46cdvQ0FD9A8J/ZIDLjY2NHTZsGGJa4j40U5MmTRAUpaens/5PWgsvtcjlHwg+ v/jiC6GDrVWrlo+PT0pKitSiVXSkpaWtWbNGV1dXaOlVqlTp16/foUOHpJaOo1hYvXq1sFlL ZDoTtMXZ2dnc3Fy0xqFOnToDBw7ct28fNKr4T5EWIIVnz5517NhRlAAuW7ZMzQ+QheQIWalr 2s/Pz8jICMQHc65evbq2tra7u/vt27dp5TsdFs/pTzWAUYh06bvvvpNaKI6cS5cuITXQkIOr qyvf/qUcYPfu3cJmjYiIKGaBSItat24trzANGjQ4duxYicisDgDN2dnZCV+wcuXKQ4cOleo4 QuUBRoPwIME9e/YgPa8mA4QHAzo6Oh44cIAN/+XIXpMzoGqwatUqoTp17969xIckOAqFFy9e 0EbxIldmYGBw5MgR3jrlAxkZGcLGHT9+fNHKOXr0KNKfJk2a1KhRo1KlSsIyjY2NN27cqOZb oxQW69evF40ItGnTpqwsT/7w4cOpU6fgY6l3mrZBMzMzCwgIoLCWTWHKESzq5ChVpKenCwcL 0ByRkZFSC1URAStOTEzctm2bvb09vJnQxhEl2tjYlKdInk56ZUfRCc9/KaNTEwuLt2/fdu3a lTVx/fr1Czvj+tWrVzExMXp6eqJICZlF48aNv/76azaOX2586YYNG4SLYTVkCzp8fX2llitP 0MBfTu6ylKdPn06bNk1HRwcWTfM/NTU1p0yZcuvWLbYFKNlCTjlqNTUHsnI3NzehUvXs2VNq oSocEhISxo0bZ2pqqqEIs2fPLourlfMCdQcJf2GsxybLSSGXqgHXLWzlOXPmKH8v8r7+/fsb GRnJa8vkyZOvX79eemJLhaSkJNHpD8Dy5ctLdiFJSYEtZ2AHGyUnJ2/dutXc3LxKlSoIcWkO TLt27ZDFZ2dnl4k1jOUVNDGJdlZHrjFhwoTMzEyphaooePTo0cSJE7t16ya/aEtD1sMTHh5e /qZGwyF8kIGNd9AuwTQHoPy9r0LEx8cLg0+kgUeOHCnQE0ZHR8NaFW5WDy3auHFjeZ0hPH36 dFHfSOfOndV2LT/r1iAlB0JCQuzt7ZGh0zmA+GzdunVAQMCzZ8/40j/JgSDk2rVrFy5cQKDC oxHVAHV+69YtNiggBKxDT09v1apVDx48KCtjHMqDOnwoMEZu++bNG0aIFc0P3Lhxgx1qQKfC LV26NK+LU1NTQ0ND5Q+nphsXLFhQXgNXeKTg4GDRW+vr6z98+FBq0fIDwjla3Af6i4qKoiW9 IHHYOz4bNGgwY8YMBMDQ+QrS88/BQYDlzp4929XVVT6M15Addztw4ECYTHmlAzrpDKFvTExM UFDQtm3b7ty5k5WVxXqNpBZQdUC+JtwcRiPvmdgnT55s3769/PwoONJJkyZduXKlHKx0yAuH Dh0SrQmqV68eNEdqufID9WlQhz/sferUqZAZ3EcjgHXq1OnZsyfalIYDyu7OPBwcyiM9PT0w MHDkyJEKOzw1ZH2euIByIqmFLUXA6u/evTtv3jw4AWQ0FhYWgwYNQpBfMc94gqv89ttvhQmd s7OzaDOKHTt2KBwjdnBwiIuLK6+REuHPP/80NzcXvbi3t7eavzUd/QBDTkpKQl7fuHHjypUr UxcoSNDOzi4kJIQUHlEQZ0COEgd0LyMjQx3O2EpJSbl161ZoaKilpaV8h6eGbJG7jY0NssLE xESphS15UG9nTq5PgMO/f/8+QmIdHR1kNJUqVUKdIO2dPHnygwcPcgRz4SoOnjx5ItrxFSSI vPivv/6C5nTs2FF4GJaGbAJk8+bNV65cWQ52dykQM2fOBHEIX79Lly4XLlyQWi4xSGnZmj7q 1X/58uWuXbvAd+z4P3xByOfn5wf6IxJn2s7OzGWTQmlcgA0ZlIicVDjJCdqlLzm5s9E4F5cb wHuMHj3a1dUVyYVUMkDZ9uzZY2trK/JgQujq6i5fvlwqCVUGsmWYG1z6tGnTKKOhCeE1atRA VNyrV68rV64wq5daXlUDSZ9oPTuyBicnJ3nNQY3NnTs3NjZWapFVAWiLKGhs167d7du3pZYr TxCDgFNod5eIiAhHR0dEeuz4PyMjoyVLlqSlpclP96J78Ts7GgmGkJ2dTWE8TZMuvoREfGyi DtuojW1bWgGtr1xi/vz5ZDJ169ZV8YaB0Kjw8HBfX184sbyIr06dOsOGDVuxYgXcviplkwq0 G3BYWNioUaOQ/VFITD4Bn3AR+P3GjRs5FXg7xBMnTtB87Hxgbm4O/ym1pCrC0aNHRX2/iAcC AwOVLwF5dGRk5NmzZ7ds2RIaGhodHV160ubkpldQYHgAaPu5c+e6deuGNqWtz5DJampqenl5 PXz4UCHRMM1nvSWUEhJKyi6ET2FiUN7H2LD4T+GQFlB7oe3069dPBU4VmoPQLiQkpHv37lpa Wnk5sXr16rm7u1+9elUdemhVAzLhe/fugea0tbWR+tF5oAzW1tb79+/PyMioyJ0wdGJ4PpqD kAk5kdRiqghv3rwR7hhAmDNnjjJHWqAmkSf6+/sbGhrq6+vTCUSIhBs1auTm5oaSS0lmSqyI uSDA2LFjq8tAYV6NGjWcnZ1Bx3///bdClhH6KLwCMkFc+ZcMND+/+E6Mzkpmq+9RPv2Zk0u7 xSyfQ01w+fJl4d4RRkZGpcqAUKQzZ85MnDixc+fOec1yoQB+zJgxp0+fLj1J1BO0HHjp0qUG BgZ0GCjbvwvVhZRw2bJlCB5oWnhFDkEPHDggWvLG0KZNm4rjoFJTU+noBGENODk5KbP84dKl S4gwRXNHGZBFDh48uDSSQcqnwH3Q4fv378+fPx+ES94A2g4eRJi3bdu2ly9fMsYRlUBdoFQC PtPT0yMiIvz8/GAdv//++7Nnz0rKNCDAq1evUMk3btzAI06cOBETE8NWVlbMHphyhvXr1wvV 3sPDo5SaFXR28ODBZs2a5cV6hJYtW8IqS0OAMoGUlJQ1a9aYmJhQxkfHYYMK8VmzZk1HR0d4 Ntbn8+7du7wai3XaCD9zBHMJcgQTb4SXCQtknipHzYw9MjKSrQ1UCHt7ezgrqcUsdaBpVq9e LYokQR8F3givjhvzGXNnmDZtWvHlFOkVDaKBXDIyMpYsWYKmpI6OqjJA/qCgIJq5xNSPFJWp K5WAOAfct3//fk9PzxYtWjRo0KBWrVoo7aeffsLv+YuUF0WSnCDfxMREqJCPj8/48eMHDRrU vHlzLS0tPT09BweHgICApKSkvKbciHZsEz1UdJ6v6Bq1srIKguHDhwsVHkFUSZWcnZ2dkJBw /PjxRYsWde3aVVtbO6+xG1iihYXF9OnTN27c+Oeff1aoPk/hNDbQ36pVq9q2bct2A6YJ4Rq5 O1j+5z//USa4ZcP0FCFTd9ObN2/AmLSoilEb+5MZJv0O74SLcQt9z8k1VbY9aenWS95AND5k yJCGDRuKVKhevXqiXzQ1NXv06LFhwwbEDGp+GFDRgJcKCwsT7XjTrl27u3fv5nULGg7/9fX1 hY4VyH0asvlX8PbFF1WYr7FfQFL+/v6IeJHAUv8nlNzQ0BCk8/TpU7AbmybKiIN9UofkgwcP 1q5da2dnB99CnagQuEaNGu3bt0cmyPoB2JQb+pPG7+Rn15DyZ2ZmIjUGh44aNQpeC8lpLRlQ OA3H4wuc1axZs+Lj4xUaAuufoUewiaM5ufs7CeeskpDC/1bkjh1JYGBgwBQeTbxixYrilwnl 3L17d//+/eVXJ4kAnQctHjp0KC4urvQGHdQWNK8MXEOzwbdu3QoPxk6sI4ujTBAVRSMjyhRL 3oNNY8OfeATKZ14FzpN5AGEoy3wF/MD58+fPnTsHUqZ9Vtmwo4Tjj3iFjh07is47QBUhPocK DRw4UGG/eqtWrTw8PKBd5SzAPn36tIj3TUxM8hk4QKODF/LPnUWAbRZfTmE2RFM38cvz589D QkJAVXTwH9QbzKKvrz9p0qR79+7RwX9sr2whTeTINBb6HB0djfwR9sJKoNliCKdBW+BWNiDI SAe/QA1ev36dF8uAlHfu3InASVdXF+UQpWrkxqL4QpOx8d3U1HTz5s3ym1CRkGylBvE+47tP uYs4hLNVhfve87MOVQ+EykzhzczMirlsKjQ0FBzas2fP/KfqQVft7e29vb1hBSX1ImURn2T7 YOATqc26detatGhBPpxGAMn0yPrwr19++UXJIIEMHLaGNByfCPvXygACxXf8yNwCC8vpC/0O 77R//35wDTIFFxcXpFHwDIxSpWLAP//8E/mISJHgkRYuXMiifVSRfHrI2AG3X716VfWSlxLk Z7/MnDkzr/6TrKyskSNHKs99RH8rV64svpxM01jvHzTw2LFjIBqa+Umd/MjjiP4o70ObwhdB XRH2sCCNZrzgXzdu3PD09ARPgfKQoFEnqoYsokZRiHn27NlDM2Qo48Prx8bGbt++fdy4ccjv bt68Kb8lLKSChiAnpWyUmE4YbrEhCfwLeeugQYPk021h4pkjizrYCl9WCcziKs6+vmqLI0eO UCcbYerUqUUoBDnC9evXIyIiXF1d8ye+unXrdurUacSIEX/88QfcLI92qD8HxnjixAk4BGZu jP5oXTBsfNq0aYmJicrYy6fcvRPxBeEuqhpWb2RkBHdhYWExduzY27dvs9xQGItSaAqy27t3 b+fOnWlQhvqUUAh5DFH4qhrgoaA/Gxsb0XJvLS0tRFAinw+3efDgQdpXRKR+eB1kB4g0ynq/ 6IsXL/r06SN6wfr16yvc7BRRE5w/AoB8Jp4pRL9+/RISEoov7afcxez0BfIgEhs8eDCtfSBO AaFAS6OiotCaf/3118WLFzdt2jRq1Kgvv/xyzZo1ycnJRHwoAe+OTBbsg/elvI+IiYwFf6LY 8ePH45WprwMEeu3atQULFvTu3RuVULNmTRgCXBCSZZE13b9/f8CAAfBRuIYtPqqUC9qmBuZA yxVhku7u7rhF9LKsnxZ8Ctql7p1PsiPvITleDbEulPnJkydoLJrqI1y7UZEneKseYK6+ffsK db5QiwGTkpJ27969atUqFCJ/8pqI+HCNr6/vyZMn4ZNL743KFticalgrYg8kL8zcNHK7QAmG hoYHDhyATSk/RkAeHhH1hAkTQAe0yyIcRZMmTbZt20atwIZm2EIqyBMWFjZ8+PDatWsT/eEW sMahQ4doWyq2OUap1YoYeBYEtrS0FNIffB1S1BUrVuS1Fzp86axZs0QzJBmQI/j4+CBhLItn Q6DtREd1A6ampufPn2eO9LkMCGZCQ0MnT56M2isU92nIjiHOa+c96OGdO3cQ9P4iADQtL4E/ 5S79y5Ed9RgTEzNx4kRoO0V3+ASbIDBGCJ2WlobkDpQ3ZMiQZs2agcugh1ZWVsuWLQNrQBMg 0v79+0GLmpqalKCRVpOZ4E9cj9QYbw0h0bgI9jZs2ODi4oLHgddwJW7ELQYGBvPmzRO1fmRk JKIsGpEE8HQiQdwoHKnEdzMzMycnJ6il8LgNIj5UO2gRRe3YsQMkDo8XFxcXHR2NnNff33/R okXTp08H18PeZ8+eDQVGbMm2dvxvLoqrIhzKAUolUvtLly4pcyNim127duWzGosBzhOB3M2b N0v7XcoiaDgD+g9vDA9GxEc9QgAZHdk4onHYEcXABRb7KXcrJ7ADUqSmTZuSn6GAWVtbe+HC hRkZGTkCOiP6A2nCsyGyJe9EIP49deoUpVqqX4URGBgor1eOjo7K3AtnO3DgQPktshnoSJHS fgUhkL9Q5RcZ8L3yL4JWO3fuHFzuUhkKNMx8UK9ePS8vL/nnImGBGvz88889evSQv6tt27a/ /vorPIP8jcLpXsh9aKUP2AQKD3JBlNW6deuNGzciooZXcXNz09fXp2knRECAtbX1mTNnoJ9I 3JydnSEhy/jIaohMUVr79u2DgoIQ24ObgoODXV1dEfLhEZQnkgmgcPAgIkPRmMKJEyeYsaAo XAxjASf27NnTzs4OmaORkREKBHlt3rwZIRbomNJMWBASOrDeb7/9Bl6Dytna2sL16ejoINbC 7V26dGnevDkolV6KwlEqv3///sePH6dBaqqifGaHUuew/BxU3plWNBw5ckSowy1atMhns02Y 7eHDhydNmjR06FDkFKRUeRkRFGzMmDGPHj1KSUkpi2F2KUF4uC3RGSLVo0ePdujQgUZDaCYb InYycxrUMDY2XrduHSJ/5YcMUD5KhruAP4EtU15JoTLobO3atTS5heWAdCgbrJi4mHwFs1aI J9/boxogIzAxMRFpF/wz4gElS0C9IQCbO3cuXJC8ouLtoMygDzhYZdaPFwcIIUaMGIHABgEG XDqSeqQqV69eLTCcwAW4DBfDYJHQCYctGMirK9xKV3nAY2/fvh2BsUjTkNeATZCL1a1bVzQN SQhaxh4eHi4vP0VNiK8QfSG5I/qjwTuQhZ+fHzK7//u//wMBUapFT6E5YAByLgRCkKFPnz4I vCFGJQGgrsQpYChwE7gPZLR8+XKQMqkxo0syMXyiCX766SdKvqj+0frIZEFzxKpoJrTRzJkz EbEgOcXTYYN4Nfi0p0+fwhlSrybCJ/AXnuXh4WFhYQHZ6FB7DdnqXeqbJbtj70K9qVQDAG4B Yx46dAgFyoe41C3DZgvkCLqUaYSRc1+RgdoTjYwPGjRI5ATgEkFhML05c+Z06tQpf/Oh0WGo FsKks2fPcuJTCKa01P9/79690aNHo97YgAj8w5AhQ7p16wbTgKXUrl17+PDhsbGxpPPKKDxZ NNKfcePGwSuSDVKQjAIRzYIZyazYTBiUnJ6eDgcLsgPzUgxMPgpuDdadmppa6lXzb0C2kydP ivb/hGADBgxQmGgUCFQ1alJPT080mEiAU0VDpKWlITYopQwXPKKQdJAFwGTgRcHs4IIv5YBX xmX5W19xgNzE3NwcBARvL1QwKAna/eLFi7169VK+tDZt2ty6dUtYh5TaPHv2DO+IB7HBNYrH xo4di/ika9eusAJoO3VWUBuxvouOHTsuWrSob9++uIZ2jKExTcZr+BNFoZw//vgDqeiwYcNg R3S6hPBxjIDwRhcuXGBzVGAFYEMwINSDZpbiQf369Tt27Bh8ICgVioELKP+C5cJY8CBw6ODB g1u2bInWgeTsPAuFYxlsea9G7vQ29t8GDRpAYGQfZOCsL1RIeXg09OfatWtXrlyhEEW4tJDz YBGAYEa0x/706dPZf+EkFyxYUODqdQICJyjnzp07cRdaR8KXUnNQJMwmasKs/P39Ed+SCdPh rYhD4A9hFOCgWrVqITEPCgpC+sA4q8CnoGRcj5AVzcdYjDqU4Ou++uorttY4JzcbxS3nz5+H W6CxEtxFOT5uATX8+OOPqh+9RdaDjECoZtra2lDRYh50DveF+gStsCUnQtSvX9/BwWHjxo2U I5csFDKghECIBfZBUgaOk5cWHn7atGl5DaTmD1QjkhpWFE1fQXZpb29PCkaL3xs1auTi4oKw BOk54mf8i7r9aRaKRu5MMAMDA1yGJkNsxkbGWRZJ30GsoD/4HxAlKAlKy4iPHqcho0viIFgc rIP6MNk4OKzg1KlTyONY57+pqenXX3996dIlBPN0AcwqKSnpt99+o9PKEO3DTKhM4jjKXuk7 VYWwo4xeRyQSvYWxsTEeRAz4IRc02o4f4SiQU/j4+OCh0E+0GqiQdYfyCaVFA9pRNJcM6Tx0 ICQkBC2rjObDnSJ/37x5M/LECriUrwhg4Ry+vHz5Ej6hffv21NVJXNOnTx93d3dbW1vkbvjR yMgItnb37t2Psr2yc5Tr8Ic5REVFoWkoVKaBD3pKu3btAgMDwQJsZR+NO4BWlixZAscl3INU QxaEI6RHLqZiE4M8qAShssH7rV+/vqRm4GRnZ+/bt69Tp07y80U1ZL0ZyAVWrlxZskOEcGL5 jEiqAMhTwA4DZaCEV+GEWCQjZ86cQeXkM8yhISNQMBfoSeFLOTs7C2sb2SW8N+uQBxDj9ejR Az9S2sWojSktsQPCHiSAuBLXwynR0CGxHlupByb99ttvkfohjcV3VhqNLFB4SVfS0gkw+507 d4g42N4yNEPVzs6ObqcRQ7wjSPDcuXPJyckxMTHQmW+++cba2hq/k4SsP5NuoeFLVgks8dSQ je/jAgiPN0JYC8qjHlqSEJWAEJQY8GPu7jf4EzSN3+fPn4/gAT6BsmM8fcyYMbRqkmqY54D5 AJXzSICtW7eiERcvXtyhQweR0jo6OipDfFCASZMmrV69GorBia9QYF36MD3YYP/+/VmqhS9f fPHFrFmzunbtCirEnzBVNze3W7dugfvY4oV8VJ1liM+ePUM8jHRSOJuFhjYmT54cGxvLCiFh EOIePXoUTIcLyLGwXlP8MmLECNWfqD5+/HjhaBdsH3pbzOxPHhkZGcgH4asVjqyhCeB2Nm3a VFKPQz0vW7asVPsz84GJiQmC2wK7aJAPdu7cWbhGmIGmUKJO/vOf/xw5cgRX3r9//+bNm6BL RAuihB2X5eROj7xx44aHhwcde0R5EGU9bdu2pY24hesOaOiZeAHevlWrVk5OTo0bN8Z3KoHG C9gOLTAWGxsbb2/vvn37Ikyi/9L8MWGxVCCCdvBpZGQkcnwK6mBTiEXxIuBoEI2hoSFdCaoi wwFhoWRwKwwTySOROOvqZIN97EeiTmZE+BMJBcK5IUOGeHl5IUVFXSH7QMCJ+KFS7iYzuCAh IYHyPhIMEsbFxdHyfMhA01DZG6H28C+EFriehTF5bVCT17/KK548eRIaGvrjjz/OlWHGjBkl YkFoelDn0qVLizYKU7Jg3p66C9giUyIXtV3qxQbyUIcwBNg1MRSd4orQlLYppgE7fME1wu5H hWrMBhZpThpikkOHDsH/VBasqacZ41ZWVjA98Min3JPOqCMFwe3IkSPh9MgYyZbJhOE216xZ o+IzmOLj40W6hwi/9B5HUyAGDBigcJ9tNM1PP/1Ugsngrl27kM6UiEkSQD3dZZgwYYJwi3sh 0PSnTp0qULY//vhDYVKsIesNAPHls13hggULhNejHJqN/PTpUzCLkZEReXsNwUmXjE1Yz4PG v7sK8TqtW7fGvWxCCyufroHSgjsQwyAsp9WFdIQ0kQXpMD2XSBN8unHjRtomAvby/PlzsPPB gwfBTQ4ODvgv21eNRvRIHrY6npGpwg5PqiUSlfW6IOmGK7506RKyD1AtTVK9fv06kjikcoys XV1dqa+V+jyhbydPnpwyZQrcAhWo8e81wuB6vAiMna24R1XT+hcKmNlucrRcqNzvMxkeHj56 9OhOnTohpoJWUO90MS1LhNq1a8NLoNrVgV/Ih7Ol3zmCNUfqzIA5uZ0bERERIClKPdBSaDVY MVoQnEgDJVD7QYMG0TG4BRaYkztNGkaEgNzT05OWFgrP2oZKIAGk7XzpRjIQcPGqVasQUrJF VWxyHdCzZ08UqMoFSvLD04sXLy7tWZo5MheRmJiISEC+6w8VqKenV1LHLaHakXsi6UZa5OLi gswCQb5oh2p7GVxkEG37SUCkBNZG/oWi4FezZXj8+HH79u3lL3Z0dMxnp1ACqh3xrcKNsqGc s2fPxrvnb1bfffed8C4oErQRDh9y0lYGlN+Rdmnk9hASBYi2XqE6hx9r1KgRzYhW2B9LR6WA IhEDkMdjxIp/0Wo+4QQYiLF69WpwBCwFgSVyroCAgKFDh6IE6D/qmfpIwVmofNxO2ZzooSw+ pDF6ZJRI0NhEF9Y9Sw+F/GCxhw8f4nFgK5AR1Cw2NhaxCiyU4lJcjGcNHjwYIcrx48cPHDjw /fffQyowOyIlsspKuXuyUc3gHZGn0/JJNDqScQS9gYGBCFGQC+MLYkiaOSDch634qqtuQFNu 374dWR5sE2GSvIaUBhC3IFj64Ycf4C4kTwZZ7kNzP/AFn2o+Lgy1RJKOdI/slEgKRufk5GRq asrmtpmbm+/cuVP5GiY9h6ObOnUq0RkRn0ZuXAqLg5nQYWesQxWGCbuDhyRjp/0uNHLnDMAw 4daSk5NLtUKEwCssX75cqG9IQsHaKhMAhALHMmfOHAsLC3nlhzBbtmwp2c5YxO2gsAsXLkQI kC5DjmzvF1HvIgCakz/5HVWHSEbEI+SEkfjn9XToAwwZBAcNlH9f2gwhKCiowJAS7t3Ozk54 L3QJd4E3QeKsq59N4GSdhIwEK+Uu62N9oWAWWnxBl4lkox9BItBSkBGZEi3iQ+aoq6vLlhdR NgcPiVyM5lteu3YNvIy8D60M0qfhOVwMzkXIt0YGFEIWKnpu5dydYeAGt23bhspp27YtcRl1 VFbKXXmBTzribfPmzXv27Nm3bx+STXjssWPH0mAlXUzJKcQD5SHjQ3PjxRmhMxZmJEvDiBB+ x44daHFQHhIfuA4IDPlRG5aWlhMnTgSZ0vopmDm8YvlbZb9o0SKF61JVBtR23759C4wtSwNs 3yHK92nONmIhWt1DG02rXiolgVgdhgCHw0wG1gqVBkOxEQQoMxIf+Eb5pa8KQZubgSnmz58P WxC5Cwoa+/XrR7tqUHhAmzUhx6Sj5Zg7YiMa+N6mTZvg4OC8Nl0pDdy7d8/MzIxJDqlOnjyp sqcLgQQBYblCzUfWprJzl/z9/UVPh9UrjIvg2+U3RLWyssp/4G/y5Mmik+WFQDKObEIZOcPC wkRrTLp06QLz/PnnnxGPEa+xTkV2EBL9yJw8u4bWwNIQoUYuY4pkEw69kYbTZ7du3UAK1tbW jG1xAXgBPyLMiIqKAgeB5lA47SZK8uBiAwODESNGgPuWLl2KHBBWqXDVzP+3d+ZBUlXXHx8G zC9lggFKEgyLCoJYsoyg4oYKwogSlICJLMoIqCAGVBCQsIrsAsLIFhaxFGQTURkF2UF2EQZB FFBAVtkiKkmsCjP5faq/9U5du2eaHphuQO73j65meP3efe/de77ne++55+i6HMyrwUuBTBs0 aKCBo5nPsJlSGJbxxeVgPX6FaNUMrT0Eo7akYF9/AWf3YoGfQzV0cFlvueWW0qVL29KqORi2 iFm7dm1u1rZv/AIYEFOPQzVt2jTkA3I+ephWnsCTxP3g7Xfp0gVfZcSIEc0C4F3wwHOrQ5oU WhyEB2fOnBnplMb1UdgX/OcFCxYwkBs2bIj8mTRpElR43mpAeuOaNWsaNWpET7aFchy/cuXK aaE/KbRBrEWLFpmZmTaTH8uZ8fcmTpxYuXJlDWr3HXEVzo+7qHVzLaFyWqRoz549LWDG1g1F zfzzscceUyKahE2hrFq1yk2v58YTJh6IBdzsO+64I7Lb87J69+4dV3bm6tBHWIgOPSTH5byD Bw+GSbCk0Oxlbi3E/9m0aVOdOnWimBFURo5ZRiOxZMmSSAkJ4+Bf8QZpc7KzNcAiVaTgkNXY Hwtr0R8hbpQjJCh6Svr5ngJD2NmKFSv24IMP0hjMEX6UXVRDrFu3bn//+9+5ZWklC3QpENr4 A6dg/fr06cN1oSpbNwxzJgsEiWX4OUZ4zJgxGzdu7NevH2PWVgbtMFWRMK2nM+jnxv4W22Mx q6aLbdVPBG0UyWm10Glpo9xGFgzSmSIVuaPDhw9byOtZdcdzCgwXD5mRqKqpufXYMwaWE2OY 46XRVl999dXKlSuRLTxPiDLHlQKeOe7ia6+9Fm9TadZbMvCHH36YMWMGvnrJkiXpS3Rs/PP3 338/igZM5O5R26xqJT5p8NChQxny2qAnlw9LxV9s6Q0nX7eQWwJqN3WSngPWct26dU2bNsXX TQ52J9mg03Ke9v/a0+P87777Lo66NUMerI5X0DW+EDYwkXkncN1tOHMvs2bNSsx1owAbsnz5 8rZt20bGi2JksKt79uyJx3V37NgRlgynSJEi48ePjzwS56dGjRph83XY+Q8++CC3k8MFkZl2 XNAljh07Fks78awitSduDKpw1KhRqB53GUu+lkiHX916662PP/443M3gNRXDb9NCgAFFiKaV kn5eLywpUGSa+cSx5JZpNv2WMVXQKSvGOeFEGqNkMrZax3XhTWgR6ceN3HzzzZZutJCTa5Rf 8fDFRGqkQmUQYhg9Rut9992nhDx2FyZRjWeN2myfftg8sLuxItmBhQAVDHbcW/MsgZvaluSk COBIbmfz5s0KlbmgGRDHmBcapbueDThz7ItNyAGoEBGaW2npAQMG5JZN92wQmTCWd4ppevPN NxUDZjMGfEcJ5ph30YqzuPEzcUVWUO1LPhjfkVS4qfIM1bHlxKoD83ecSXTZoUOH3JOEndYq pmk5D2zfvr1jx45Kf62hoZWX5CBeDn+ec7rFbbdu3Yrxufzyy22Y28SUvEqMxrJlyyyuLAGP C6JxzTiyIvG7MHLDiRMnJkyYkOMwLF++/DvvvJPvV+SFhl2ofv36ObLSggULItm5R48eOe5U +umnn7D2p9309PDDD5+2hfjGCOEcJ4gGDx5MUx977DFRmzvBXihU6ATjzG+XLl0KZ1WuXNmd hIdrbrvtNlSbjIxpKyV2sJxpxjWYes7A2TZs2IBYwP5gAZTX3bYPWLxNwSAjmViMPoZjv2LF ismTJ/N4jV9sIoUvFStWfOqpp3gd8LX0rFES1AMJjh49+o033lC0j61v2qNw2d9u0yiME9J/ rrvuOohYa5GuirQbtEVSrXUqhlbLkclB+I3Rrg1nxOyHH36oItf50CPPEWg8luqM5zzpCX/6 05+QAJ06dVqzZs2iRYvCdvo899xzeX0+GF66Gf55ZK4k2nn77bfne6rhrKCuVnbAhrt37x40 aJAKvhQIwh1luhs2bBgpaS3+32ox528Lc4MVos0KlUcZN26chLz1VY01jUroj3e9ZcsW7fHJ zXMzCayTIxYGDhyoxDLuKl6BIPQuJSVl7ty5XN3I9MCBA4888ojoLyk0M4OXyz9lZORVYhAg oBhzcecLMFxuX2rcuHFirhs7oI+ZM2dG1lng6SES87HbY3LDhnylSpV4azk2qWXLlu6RvDtE UI49HLWiVbnoRuPqq6+Ovnq4cePGZs2aRc63C7Vr1z5y5Minn35Kx7NZvqTAgOOn0fc+/vhj bAiNnz59uubhk4JgjwJBypQCP899nRQovgJBrDL/xdkeffTRhQsX4sZrwYvTIsyh+GQnuqZQ UHNTf4Rk77zzToTwkiVLeKroOGhOM7E2f8JA4I+cavXq1ZwcbkVP9e3bF7a1GVStuEFhffr0 4e/crMtiboMLBtsY9b/oX3yM9PT09957Dz+Th0B7dKSMmPtg9UebOHX1L39n2EK+iFD8jVat WsHI2ruhaFiY/ccff7zQNwOOHTs2MiQpNzAYS5QogW/TokULvFb6IU/AdBkugev+4efjeJ9x w3DzhgwZgsPmFongTTE6zrLMbhhsp0N2yP5zcpxMbIK7T0eeG12re/fukUksjTWkmxLmFOla yjv9xRdfMPZ5QTbAjbtxVHAC8VUku7JDKzW5aVUrPw327duH7q5evbrWBczRNSeZLw888ACD V9slNHWMGYeILRcNg11xaPY8aSRG2E3Gm4BBNHLkSNc484rjfcUzg+pgRsqou+++GzF4ljtx NM1StGhR98xYuXnz5uV4PGMwbAcEzQgL34UXdu3aNX78+NKlS8diQ6CGyAthQ3bu3InefPLJ J0uVKpXjD3l99CtcMtXYUgpWRqU0Cwq6Vq1anBxXXIFYdEUElJX5s5OIXCxcJClQUjY/D9dw LzhpuMHr1q2ziDjOieShI2k+JNmJJ9HyGU3CXnXt2hWf8JtvvuGH+C1wqG3f0wjin1AJPZBb hv40cDiYx4h3ITFo1MaZGYDu5oVkZ+eCuE8ajU8ESLly5bRIyu3zHOgwmZmZqg2qZT6jvzDB aKuQylmE1mjduvUrr7zCS8Enoamff/652N/icIYNG6YNxRfJLCiiLCMjY/369TlOgODMhA0W Xv3ZN+/EiRN4Ghhw98z4yflIgqeCqqyiPzphlSpVbNOrqX7aAPlymznevsy4lGB+NSw6soJy J3Ry+uGbb76JV2mzjvZFK9r333//Bx98IIfN9rFmR8yC6mzZQWndKVOmMPTcRC6mK2U0GHHY HBxdNYbzr1y5kvfOFRXsLUc6LS1N5el1hj/+8Y/4NpYzKjGPC4vkRt/hnyfmumeGOXPmRIZ/ 4DlEWX2LBdu3b49MGtO/f//cjt+zZ4/LxXBTZPQmbrAbYXtaTJw4MewMkHJqampuxGeAuBWo g2HHT9DuHq1wQRkYeR7aoUOHtFNeyUKHDh2qTOzuDJ67iJbkzB+K/jD+OHVQ54YNG44fP269 VDttwYoVK+rUqSPatYlEGtOoUSMIAiGMh0wD5AyjRiE786LFMtxI3bp1YUAkA1QOS9JsmB0G hG6aN2+OyigYgOevxUSMnkWwCEbcuLhI3Ztuuunxxx8fNWoUVKWmam8+L0gpLNTUpGDB1CVQ 7VXEwYDBuRHU6EcffcSQ0ZYHiw1ALlnpKH740ksvweAXeiRMdiijYOPGjfE0ED6Mu+oh1KtX D3+sU6dO+Dy4VaeNWHj99dfd7kp/xvfIrxbSt3nF7vlpWz7ulVAnh/7w+mi5myAoOYiFxsOk x+ao7/gtPUE7JrITNQtqcTt8wjtYANsYJadU44Wh2rJlSww+PqHlhLcWRjKgbXHFAtSsWVN7 oGQ66PzXXHONFlA0aipXrox8kK5kxOEeQH8qGGGD/W9/+1vPnj01qJNCk6L0LsyIpdlJ2PBx 17OwFYm56BkDA96uXbtLfl6QiKfaq1evM8sWiD187LHHwmgFexvlJ2H70OlIbvYPTDdyA9ER nbnCwC3gYTZo0OCOO+6webzT/orubSW0YBaMMy1X2hM++Q45KheZJSPCetM5q1atajvl1Wlt Kc2dP8T+w30QDaS5bds22XzpPvqnCEWn5b2MGTMGTlEEC8SEe4nbjG+gRTH9Sj/HL1WxQguP 0aqEBCO8WaFCBSgSQuQGeSCcTVExxlDajYh9btOmDcNNWtJCRpX+FMKaPXs2clXkmx0aVjZd 8Nlnn3GMhQTYGh+faB9cXKQNw7Zfv348LrQeokOiwGyFMeD06dMVfSTa7dOnj+rUX+gMmB0a HXjy2HC61oEQeA6x/5yHgD5ye+x9992Xj/vm6Et0sDD3FVNwZmdzzb7eHa/466+/HjBgAFLF psHtQnLGGLN0DzqYraOpj/HbgwcPpqenP/PMMwyfGTNmYBlsq51LN9GbZNOS5nSFHXMqKPRs LdeopNt37txZxakL/hwMn1tvvfW9997Dt6SFeCmQ+O7du7W1X/diDTBFxovDe8H6yd9zT8Vg 0YyB5mcefPBB7l3N2L9/P81A35mPzQi96667li5dykixgCLGHcNZK0HuhkQ3MWmchKHLgLi7 MW5GO4fgBSH6brjhBrfb8yLOgAR5pzNnzgyLq8SIYTaj/ArL7B4/ZcqU7FB+G9TKn//8Z6Rf jilP8xcwAn6pbZ0wOYbXh9F+9tlnGXTr1693h6R6Nf0ZbdW2bVtt/TP7zycdG+KGiPnEqaOX 0tsZHXCfyldFuojuX44ePYooGBUC1IOviLU03/iUU6Hsrbfesvl/t2yfu+aYHFQWsxkndwiL azSxydmaNm0KneGN48IxrLQUpb29urrbDH3BPgwfPhz2xH6iI0qXLg1941yh4P7xj3+gUjEI hw8fth3ukd3ACJ3eyENLDtLjDBs2jMeVyNX88xYYNHcFH88kSqaIM0bYdCid6gxW3GwfnC0/ KfITgsDUqJeGjUG9cTqeiobojVsJLQwCtEKnwq9D6aSkpEAE9DpbWMxT86IsioVRpL4w5PF+ ubqcW4vYoc2YDnzaIUOGMFJq166Nzcdk0YFxJiFEmq3JIhGfOjngjzjb2FiONxXMafEVn3/+ eRwbpdDXogN2g4FDGxgIr732Gid3Nx/h3w4cOBBr2a1bN5lKuZ1du3ZVThLbcyEuPhWUOo1T 3jmMhr1TeGTcuHEXxMjFh8dFdxfraXzv3r3z1Ph33nknbLm/ZMmS/fv3j5LREfc+rGonHRua eOihh7DqkcMk30GDeWWR+QFsxYFhC8dh/5XXzpjLnE/uDtnSsGFDVRqi6+Kh0ZMZEdOmTZs7 dy6cwpdly5bt27ePk5w2P7xB64zwMtyXY1YHjanVq1fjJUI9ygth0dTJTvxqUrAvz/1noSCj BV8YtlDVP//5T+Tn9u3bcVpWrVqFm81faIOEp0Wz5xjdvWfPnjlz5tDhR44ciRWFvnFcvwsh llUbe56bNm3CktgC5dixY9V/fpFZ0fIE3oi7XtC8efM45fpo3769XYUX0bp167yWWssKakRm B5OfjKBJkyZBfxrUkcFsBUIx/x07dtS8q6ot2wIB2geTjnNlTh3u1saNG9W1zKqftmFuq7Jz 6sl2gMiXTx4yVNuzZ09cDk1uiK0U/ZKamoqTxiNiBGkuRUFceBFPP/00g1erFXZ+EStPg1/J xBmd4Sfzx6lTp2I95K+CUqVKIQrUBswI9GcJ83lo2JwXXnhh7969vCAxoB5OmTJl8JyNwbMd Qrf6hnEiJhrjVnLHXcESJiApaL4Ac+0mpuZFx74miJWuV69eWK+m20T/FUYyTH4mDFdffTWd J8ct87bnVPON7hyCTZK4sW30Z6wT/m2LFi0QPrBAZmYm3GF7iCzyWd9jXMc3HzhyL5V7APTE 1ZFgDzzwACOiaNGiWlbQfKxpwORgU4YbtCMByGjFDdDOO6s2aAmKrYpfFM/ZmqfUvnJZ3SK5 p4VNh2LrGjRoIEOHKztjxgzZ+YQFP5yfwFdEVljv5cW98sorcbrWli1bXCP2l7/8JcattQZL aa5ugw/5xhtv4OtaFqNIBuQvKFykll63O0vJSTIyMm6++WabzeD2ORi1aHOk2c7URG4wFaae eSqn7KPuWNMnl0Br16xZ0xVrmjZRetUnnniCcWcL39qQy8E4cigLPMAwtcWARSyo0qhIs2Ao G8azzz4L+8NcVuSav1evXh2i37179+DBg6tVq6Y9UNqMD9/h+q5du5a7wI7BgPo7jeQMY8aM ce/RTU3jTkDFA/C466qhCODuC6UIlyLx1HKeJHY1ll9xdy+99FJYlT2ctFgScT/88MOxEJYS PkdJ7sQBmAg6SVhIm4HbwYesUaNGrVq1BgwYEGWJ31ambI7FCDH7596jDVLpNaw3XVHz/3Y2 G27uckCegpPtipE/yQrtUcLF4hVs3boVN7tDhw516tRJSUlRwu0/hgCVXHbZZYzZ/wugRclK lSpBN/369UN5mVR3J2Ozgg1c2TEMHDs47AZjuVO7R3xIqFw2hLtYv369MkFd5Bpw5cqVbsfm ba5YsSJ+l3vqqafcsYNTl6efW7AHn4iXyZMnK/zY1qnDljb4C3eEG8bbl9OVHfRDCHHnzp2t WrXSZjcjIPxtq5KQp76hwai867k13sYsgxr3snHjxoULF04KPEbt08ExQJ3h9GJVLDBGcTKS iuXKlYMcu3Tpsnz5cgWMKXJg6dKlUKcyBmuuQ2ULeMW4zZ07d7ZUgVBkkyZN8Ap69Ohx1VVX ifWSg03BVatWHT9+PC1UjBBcrJV3fkhXefXVV7Oc3Du2smN7NOI3OcnNDho0yHVy8BBUO+b8 nxGlY7iUhCuI+3HaXyEVw/ZW4P98/PHHsVwRR65ChQpRuE9xYsjJPXv2REkBirVkRGzbtg17 TheyXQyXBlCTYpk4UlcJY8D/OchyYF6lZk1N5bnHhJ35VGwZTsLUYo4a0GYzrM342+vWrVuw YMFHH33Ee3n33Xdnz549duzYvn37Pvfccy1btkxLS2NgMtDwNnFu4T7tNbNSNbZQ7jrMbmxA jo/LbsoGnX2JZSHJbuTgwYOtW7fWWE5NTT1w4EAUY3WRgAeIDXQXBVS8Mn7AlXIHV47bi8Lg 9nP1IiwePiGnwu20zaqaeLc9oUlBvPGVV16prVhGf/I5IYXRo0eXLFnSJBiOHOP6kUce0Xp6 tjNpE93A6jDIApvz/vvvw0Tbt293tYnxqc5z+PDhhQsXNm3atEiRIvIbbW2uWbNm8+fPHzp0 aMWKFW3TU6EAFgJNU4sWLYo7gazWLJDKimnXbVJoFQbLWbduXc7G48Jb4GA7GyyJNW7Xrl2J EiVMO8t/wL9F5fF4bZ0ULwVHV+tQtJDxrjTjMiN8njhxgmZgE7RCEW+XUmk9XDN+4403Tpgw 4TyfEeWhNWrUyO38AwcOPO2vEONhfITVjfGKPBB8v8hZEQHHb8SIEbt27eLIwYMH50Z/DB+F 0Aj0pdWrV9Opzqz4i4kdK13nSqHsYIDbunb2z1WS/SoSdnwsExFZQYRbbiSSFewONsb5bwAj RF0R3sf5xJgwxI4cOXLs2DG0Kn/RPNWpIBQz25mNdD3hbGd2KDcitsiHbMeLzgp2b53W97Nj aNWwYcNUe0IMKKt4PheMizfozzVr1nQ7/AsvvBDXK/IW3MvVqVMn+vHuMpx5hjCUcg2JO4zv CgTZmy0aGYeHdy2asLU/rLoG8p133mkEKmWEaMLCS1PYGLHkLfYX8+hsGoch8Pbbb99///34 9jfddNNDDz2ElbBt4/qiNhw9evT111+nVegpaS7RH2SEJJw7dy7uNA0z0WfPytbZLRqca02d OpU+vHnzZkVyaklCpHb99dcrR312iHNRu7afCHIsXbq0Em64ceaKfhH96ZYZyChNVKEeKY8I M75169ZTofSh3MvGjRtffvll3AZVccIljjFn8hmD14cYCUvOz+O67rrruDqPIpElk04L3ANY hheBcg+baTxtcm8ebBh/0UPytEaPBuGluCoSZwbVj5Q2BYrpzq02Pb1i+PDh8SincmaaPcFK P7fL5WmiNX5tjrEZRpqMaHxUnKJatWr16tVLzupFrgEXL17sjg5Md255sPMR7hDD1Ec50n3F 5pJhAJEbtWvXxhrnNmyVukEbunF7tDfEvClsyKFDh5CfSDA3qpkfpqSkzJs3z5xJrqjCzZwB Y6JKzeozNgHI2fbt2wep3XbbbZZyE5HSpk0bHqa1X5fGRYRiqlSpouSEtsMXbdW8efPMzMy1 a9e2aNFCG9Jz3GnlBmPD1xMnTqQnQ38mZsWqnJBOjpUT78NKaWlpto+4QJBasECQVhdFUL16 9QEDBuzcuVPPWQvufNmxY4fyIhYM5SIuX7489hO1y1vgyz333AOTqlYp94UETkDJaV5H27Zt c+wAuAG8RBQuTwafRFXv492eSMgpwlWgJfgGYfkGhY4dO0Y5A/0QTnePp4PxdvLaEl4Hp+rR owfO7bRp0/BncAjdd/Tee+/lOI4A4nr79u1ncv8e5w2ynOjBf/3rX7xQOgAmS/bwF1kfMEZg z8PKnDFAEnDd2BnwVFC8wyYBMM7r1q178MEHjWsih624T3li0WKbNm3KCkK/tJLO58yZMzH4 RkCKtOR4fOxt27Zp3gC2QpF16tQJ9dSuXTsI5dNPP7UQMk2JcCokG9ZYHn7BoOyminChj6Sk 6HgQyldfffXSSy+h9bTopthLhaDwHBYsWLB3717tDXTncsPoT1+k3a655poxY8aMGDECr17z nwr15AzQKF1dUxy0FiWITNNtJju5pCyJIoIavkDTuXenL/y2T58+aEZT1mXLlr355puhQi2h ihz5cu+992Lzz2CTy5kBwx69ioFA44cOHfrhhx9q23Vew4/zBDwr+sPkyZO7du0avVVXXHFF 9GShL774YthPJk2aFI82T5kyJbdGpqenx+OKHonHKacQkk3G/hTCRcuA+PZujemiRYvGqZhL GNwhlltSX8HelGYReYO7du3CMrh16yKHrcV1VKxYccKECcgfzZlnhwiUN75mzRqYTmtbtmc8 OZQvHYH2/fffc7kvv/xy3LhxtWrV4rGg1woXLsz/9uzZk7PZHP7hw4czMjIgWWUvdJPiXnrp pU888QTqTGTKJyek5TTJ8robXZYqVQorjfF866234GVrT9h9uYxfMJR396677kLZ4ai7uSYQ 9Q0aNMDa20PLCkUNaRHcjTsVz9JURNPo0aOVk8p2StrMiUQ37GY7oeRjaO5UU81K2j9q1Cjo MmEMqGwGODPIZ1VRzM2SFwhVBsExKB0CvImH8PTTTyPQunTpMmvWrPkOeHSfffYZWgnfafPm zciurSHgOfO/fFm9ejUS2I6fOnUqL6JZs2a4BHQSHkWUlgi4EJw8yoNauXJl2P73Dh065G8B egMdI8dGPvroo+f50qpHjHDTHZ8KqsbYIs65bds5xCuvvOJ2eDRLnjLJnBnWr1/vXhTrHeWi xoB6XzAONlaZ+izvWdiwFREoeh/DqCR7/wslYBEdYDO7detWvHhxq7xpXIAN/+ijjxj1NLJ7 9+5Wm0y7cflEMmMPpUZRWDSmfv36WDy3PcrRB9NBZ7At1+UT16J3794q/u4meFdsZ2pq6qpV qyD3pk2b0jDbxxd2azaHmRRieZpEgytXrqztugWC4jI1atTAq+cubPaDp4fx7N+/P5LNGEFn 4/g77rgDrtfGZD0ld1Do4dO2QYMGqSibbjYptEFed43Zx/5zv/v3708Y/YUB5Q7v467Enig+ N3BfZcqUwe0pWbIkdMmrvPrqq68KgefGJ1dxN/flCRBxy5Yto9eMpsPQJdxfobjjF65Arwtr JLdZrVo1P//5i4EbVRsWWJid8NXV8weIFOvz2I0cK2zmO95//313rJ12HVDcp5ilJUuWYN5t 57tQIKhyIsrQvKISGY0YMUI5H3jRJ0+e5AzffffdjBkzVC3dkixZ9AiMuXTpUiz53XffrSVC oyHpynr16sGA//nPf77++us2bdoo8sRyItmudiQqJCsBCK1kZma2a9eOgyUN3MQv/IUL9erV CwKaPXs2ktxmFAsFJb3E6UlONvikIK3ZZZddhq6xUyWHCr7Dy/v27bMth3qG6LhFixZVqVIl zBpzp2gobXywOB8TubYeKvWNQK5QoYLdrwJjrr32WsgdZaQfntskSzRy7NixSHX0S2ShonML HKpnn30W5+q0gSWTJ092VSReCp02Tk+MEXHPPfeENRWKZyCcK2fGI3/h7kG2fZdZwQaTHGNQ LxKkpKRYny9WrFg8Ir4iEcaA999/f5SD7TVhyZFRaWlp2j3nwjIUJTtVw/gsVapURkaGYlek /iAj/tKwYUOIQ9SW7KTY/cMf/oBzjuXUfFqyk5Fec4x8/vWvf127du2bb76JGJTcsOlEQRv3 oJVly5ZJAC5evLhFixYqS13IqVOpf0KF+ADz58/fu3fvk08+aZXLLBmvVSnSllv90PSjm34Q MkKzQEY7duz4b1B20PLG8J0H2KpVKwU+cRWaxF288847kG9WkAgxR6Nn44UzpKenN27cuFKl SmXLlkWBPvfcc6hmCFfr6TbpGp++kwfw3rkvVMzy5cvXrVvXpEkTuJtXnI+MFguQkOjHG264 AZcJromFU/BGwgTgvffeG78kqN9++21Y+lCe0oIFC+J0OQ+P8wfYMev21apVS8xF8c/d4YbF jnLwqaBg39GjR3GMlbsszMgopMQiOvRPiINx/fnnn8sgYw8x759++ukjjzxSokQJC7N09SOM hkvAJVRLQicUrxUKKuVhmnDjb7nlFmVc0aIbzoOdkGOUgwXDAuFCl7CqlQYTsSYFk5D884or rujbt+/hw4chF/hIAlD78my5UFkmVKZTt2wLgrbzXSWt4SNMpfKFivhstp/PH3/8cc6cOffd dx82GRUM4WLorERmFPIyF5HzcF+omOnTp+MGLFy4cPfu3armpsPMq8z/fnN24Jl8+eWXtHxu CDS+Q4cOqHiV9cEZKF68OCI9t+ji6OC9lAoBpuMltgmBPsCFkP+oYzyE2L0C2unWO6M7ffLJ J3F9OLSwTp06cuS4Cx5OXC/n4XGewGVAdEpiLupmYANDhgyJfrzyBy5ZsuSee+6xrJUG00Fl ypTB39bcERYJlde5c2fVr9QkHnJA+T8jLZiWwy4JYPvjrDKmCTdME0R5SVDWE2qDZ6tXr64Y GKFGjRroXDz5pUuXIj3gOEVp2rb9QkHlej6xPB9//LGWODt16qR6MRafo5VK/njXXXf1798f A5vs1ESzCVL+Cf0NGzYMGrUc+6eCjKaSb1pFolWwwJQpUzDOHGxxL0ZhOZKX7Q621Bb2XwqV cXfp5mtnSRDoG6qIOnPmTBySbt264Utoz1TfEOg53bt31/cePXp06dJF35955hk+33jjjXxs zAMPPOB2ztq1a8cpACYMr776aizpKTw8fgHAUvXr18+NGcB+JuC6hw4dCqvDe1oGREnt3LkT dvjd736XY0J7/lihQoV27dqp8KVYEjbEldU8JNb7q6++QnuWLVvWlvaMaJICSWVzj4WcgpvG RPqV5Y4GUBs6Av/8+eef17Sq6nYhM+fPn8993X777YULF3YXKJGf11xzjdiTg/lfJDDcp02F GFJ4XJs4RKaq3ansZwcOHOAeFZmTHGTilVrEkxk/fjwyWXulbcO+m2nKNvVb/TV9scVxWyaI jA0zZgxTi+6ponPohQW5BCdPnnT3otp3N1Io31fK6Khhy5cDBgzI30tEgV/487hIwChmZJme wuq+++67Cbjuxo0b3dFdtWrV0yb4xRC9/PLL1157rSYnw+hPhQ8GDx6M7MJ5tpUydNmiRYuU gH3//v19+vSBJY3RlBTlN7/5ja0b2vSjJlH5X5ga91uJqbXQVjAox8kBEBPO/+rVq48cOYLn LAZUZMhtt92G9NP2QJtl5SdYtvbt28OPIjhOWLFiReSYtiiCzZs3p6WloVKlYUuWLFm/fv3R o0djFVVHnudQvHhxl6w5DJ7lGNV5l9ALk2lm1v4blKSXV2ApnrKdxFO5zYK6WZvCjnETWGXn lNvQI3YwHMqXL+/28NhzoHl4eMQObKbJsebNm6MgEnDRqVOnuhOYkEjkMSZGpDVWrFhx9913 S3wZYYmtoC2YsXv37tu3b581a9Z1112XHGRCa9iwIcYEbXLw4MFx48ZpEc3EF0rqlltuufHG GzXVaek3Na94+eWXp6amosjmzZuHrjT60yfkmJKSAhlx5n+HwPkhSnGoWEkzpRaqynfaiejO yMiApmFe6UoauWPHDkt1CMdxsyjKBg0aPPXUU6hIHIYTJ06I0XgUS5YsufXWW5UuRklEaef0 6dMtxCK3DIeRf3EVTf6+Yo+zwdtvv+2uRRYrViwBG5Q8PC5O7N27t1OnTkiYeCdyFL7++muY yJ29XLZsWY5HmuJAvj399NNQkla+JFfFYqIV2GfPnj3oRCSt0mzCLBzPfR07dmznzp3Iw8qV K2t9UASnGEi4GK6BzmxWUxmqUZRQ1datW3/44Yddu3a1bt0awlI+fNoA0z366KP8VunONPuH 2ORXOoMaabvtpBnRg7179/7iiy8WL16MElT8DCpy5MiRtuP4VFBnFlHJHakKmBXL1lwl/zVp 0iQaX61aNaQf7ecBqlZaAhKReSQAHTp0cAUg/lJiIrQ9PDzijYEDB7qjG8kWmXHCjSfEqi9f vhzKcPe72VRkqVKlunXrhpLF/sMXXbt2tWRi8FH//v3nz5/fqlWrsmXLKoRSTFemTJlnnnkm MzMTfpwwYQI0pBgYLSBWqlRp6NCh33zzjcIpIdYZM2YgAxXph2SGHLds2aJm2+wfZ9NWdxOn oj+pS/4rPT0d9udXePhXXXWVYjs526pVq9zkDFb2RapQlXyzHQZUFYbdu3dv27aNi+reLT3p ebINweNsgH/ljpG8lpL38PA4P4HRDotjadu2beRh/wvKKBsDIvTEgBaTCVtVr1592LBhynsJ W8ELsOFll12mRbeSJUs2bNgwNTUV+ab8MKIkFFzHjh21RQKWQeLBaFWrVv3973+PMLzppps4 5759+7SaZrILnpo9eza6b+HChUr5pWBL0RP/PHz4cJcuXSB022IvKqSdNWrUGD16NIJR+xl7 9OihfG5FihSBnaEwSb/siDIoUVbTXLJToKxtxIvXy/NIFPDQ3DESS/kkDw+P8xzfffddixYt 3K185cuXRxZF+YkoYPPmzcpfnRTsfUPo3XjjjcripQASiaZevXpJAyobDGxoq37K0onca9eu 3RdffKEIEBQZv4XRFi9eDEkNGDBg2bJlx48fN/3lEoqIxuIeLXjSCAt+h1uRexDc5ZdfzieN hOMQfdw714LmMjIyatasKTegXLlyY8aMEffZtgWXAXPL1/c/pyK2xbHYjr/8fWseiYfLgFde eeVFXrnGw+MXAEbxkCFDXM8WbsotA5sFHErmQFiwhu1z54d169adMGHCoUOHlO3T5g/T09Ox GJbh0/JqKuqybNmyzz///CeffCIis2KXat7Jkye///57bZ2wSUUjO1NYbplCd7+58qtD6NOm TRs+fPigQYNGjBgxb948JJ5SsUnoTZo0Cd6XGk1JSZkxY4ZVWdIl7MbDdt65hGttznbqa7uF M+L/Pj3iiCZNmtgwqV+//rlujoeHx9kCBVSjRg2XARs1auTWT4+Co0ePvvjii1WqVEFelShR omrVqq+99trBgwdl9l1BtGHDBk6rWBTLnKlZU/Rg+/btYago2irfYVc5FVSHnzVrFnq2cOHC tLBly5aqze3h4WLmzJmWum369OnnujkeHh75gDvvvNPiPxs0aLBp06YYf4jk2bNnz4IFC+bM mTNq1Ch0E8Rh2Z5tFxvfjx8/jtLUjnLjPtUNf+KJJxYtWqQEoVa0Pd7IcgrjZofUGdL12muv /dWvflWsWDFoPTGJPjwuLNBt1qxZM3HiRPylb7/99lw3x8PDIx+QkZFRt27datWqjRkz5tCh Q3n6rZb5/v3vf8NxyEmbALRKBFbPbu3atW3btlVdG6TWFVdckZqaOnLkyC1btii/hw5O2JZt m5/kE93aqVOnsmXLQtDly5efNm2a37/g4eHhcZHgm2++OQPxZStuoi0oTHsEbI3MavFAKNDc l19+OWLEiFatWqWlpQ0fPjwzM/P777/XYSKjrKBUbgKgJUKtIdKwJk2aoAF/+9vf1qlTR2Xr E9MMDw8PD48LEVlBfUDLuuwu5FmayuxQITwFz/C/P/zww7Fjx7RhQVEo8KZLmolpeXagVcGJ Eycef/zx4sWLX3LJJS1btty5c+fFXJrZw8PDwyNPiAz4N5axf9ruAHdreeKbmu1kHrPPzp07 Fy1a9NJLL+3SpUtep4I9PDw8PDwuXAwdOrRMmTK//vWv27dvv3//fq8BPTw8PDwuEsydO7de vXpFihRRIlZlnvHw8PDw8PjF48iRI2PHjr3++usbNWq0bt06Hwvq4eHh4XGR4Kefftq1a1d6 enrnzp2XLVvmc/57eHh4eFwkUGna48ePHzx4UFX/znWLPDw8PDw8EgdPfB4eHh4eHh4eHh4e Hh4eHh4eHh4eHh4eHh4eHh6/MJw8edJvBfXw8PDwuAixYcOGAwcOnOtWeHh4eHh4eHh4eHh4 eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4 eHh4eHh4eHh4eHh4eHh4eHh4eFxI+H+5IqmSDQplbmRzdHJlYW0NCmVuZG9iag0KMzAgMCBv YmoNCjw8L1RpdGxlKE9jdG9iZXIgMTYsIDIwMDUpIC9BdXRob3IoZHQ2OTlhKSAvQ3JlYXRv cij+/wBNAGkAYwByAG8AcwBvAGYAdACuACAAVwBvAHIAZAAgADIAMAAxADMpIC9DcmVhdGlv bkRhdGUoRDoyMDE2MDcyNTEwNTM0OS0wNScwMCcpIC9Nb2REYXRlKEQ6MjAxNjA3MjUxMDUz NDktMDUnMDAnKSAvUHJvZHVjZXIo/v8ATQBpAGMAcgBvAHMAbwBmAHQArgAgAFcAbwByAGQA IAAyADAAMQAzKSA+Pg0KZW5kb2JqDQozNyAwIG9iag0KPDwvVHlwZS9PYmpTdG0vTiA0Ni9G aXJzdCAzNDYvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA3NDE+Pg0Kc3RyZWFtDQp4nM2X T2vbQBDF74V+hzm2J2n/70IIhCahJSQEO9BDCEVxto6IbAVFhubb963Gad2iOtGeetFod+f9 tDM8yWtlqCTlyQVSgYQypEsSQZAWJLUkrUhJBE0KKRrLqiRtSXukODIKa56MV6QDWaXJlGS9 ISPIKaxLcj4gjTyARpMPioyhAJKxFAJSHIkSYuNJiBJJ2IaAwGIfsjRkBSKSrMT2yvQQRExa TUIL5BlEXKwlYQTywDMWeeBZiTzwrFPkwHPSkAPPOUcOPI96sSS8xxi8gB448AIa4CzJEuUj VZbBEmqTAvtUqTEQo3JpsBmlSLqAeeR7LKJpqsRzDg6KyyQqaVbMi9N6uelicdT0H9rmefVY L74t2qbtbFl+pOLq+TEW877bLPqTJq6Ks2sqb6i4XJJK+sPD9+9GcSM6kamTe3WXYxL1lkdN rljqzJL/JRzdu55erpkusdMlbrrET5eE6RKx35Hjmv1uHNdkOFHst+K4JsMCIsMDIsMEIsMF IsMGIsMHMsMHMsMHMsMHMsMHMsMHMsMHMsMHMuPLpvK/hpM0JvtznVOVzdC4DI3P0IQMjXjl 127v5/RvkXgRVV0/aol0yJulY94QwhBwzhuC4KA4aA4swDlvCI4DyzXLDcsNy3HOGwJTDFMM UwxTDFMMUwxTLFMsUyxTLFMsUyxTLFMsUyxTLFMcUxxTHFMcUxxTHFMcU9xAuaFtC3dadtXF OGvbvpi1TTyvHtMxLzUXrY3rYTUd+NJM6qtmzM7qRfzRn8Vnklv0KVjrto/FRbqcrO9+D66Q etv+KOZx0RefY3UXO75Pmpf7L+umXsf5fZV2mCaO1iBUfd2ut+Our79XuBlGX9vu4bZtH4rj drFZYU/DzNN9jD2747xadO3O+NM9rjvj47pq2uXOxLyp7+JOLj8HacuuWm3f8m2tF5vV03X6 O8FNHo7Cv9r8igv/c9/dUKrgz3dlrxXf6sGtaRP/J2tmbNkNCmVuZHN0cmVhbQ0KZW5kb2Jq DQo3OCAwIG9iag0KWyAyNTBdIA0KZW5kb2JqDQo3OSAwIG9iag0KWyAzMTNdIA0KZW5kb2Jq DQo4MCAwIG9iag0KPDwvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAzNjU2NS9MZW5ndGgx IDE5MDMwMD4+DQpzdHJlYW0NCnic7J0LfFTF+fefOefsbvaSZJNsLiTAbghgJEAwgXDVLOQC AgoCpgmC5LabiAQiRKo2CZRaqxEtVovXIu1f0VKqS0AMFJUqtYioQL0gVYtKkVovVNEiBfb9 zexuSGgoYtvP+6E+35PnN8/MmZkzt3P2DORCgoiSIAaVF069eOzcBxccJe3FrURp94wtLCo+ lPX3l0kz3iLSvWMnT5ra+J1ly0iL6k70SPHYqZePGX/n739O2uPVRN2vnDht6ri0gTElRD1W EkWXTpqanbN39BW1ROIgrlJeUnhJ6cI3m3C+3xEi076quop6ka5ZSLx8M85PrFrY4Lll/fI5 JPa+iutF+etr6t7Of7wS5xE3T6ipWFBPyWRFe3Ygv7NmzvX+u7wv7SDxNtpnHKytrrvugSO0 nmjQHhI/C9T6Kqr/qOWMxfXnIH9eLRJiS013IP4Q4r1r6xqu85ToASJtHPpbcrVv/lyaRBUk jtfjfMqceVUV3eYkHybxHsYjdXVdxXX1cZeYUb/YhvOeuRV1vvcHXPow8qP9lt718xY0BMto Cdq3Rp6vn++rf/fg3okkXvOgv2tJjrUpdsZ5RzesmBU76gtKiyLJY1s2dZfh7zb1KPrH4BPF Dk9UMaLoJ4VAuShxoozI4f/H4KM3ODyqpo58R6ZET6PzwmU0cpKXLsco3mGeoFJ0/XaxjEwU ZbrPlIsq+4RCfSUt0dZGkWY3G7rJMDTjXRoY3ELlV6DM+bLgJVM9HtTloZXmnmjDyCghHvEI EfRkYsxnmnbJnpIRFW6Stjhsj9J+PY/m0zmCuR/d/d+q25hDI79JOe09uvk/3RaGYRiGYRiG YRiGYRiGYRiGYRjm/zfR04Ti65fo1nVy5xr6/xtNYhiGYRiGYRiGObcQ8sC+ykFHooIURVHB E2QlK9RGNqid7FAHRQePU7TSGIoNHqNYckKdFAeNo3hoPCVAEygR6qIkaCIlQ5OUJlNK8B+U QqnBo9iaSU2lNGga9YB2p57QHkp7kgfqpnSoB/oVpVMvaC/qDc2gPtDe1Bfah84LHqG+lAk9 T2km9Qv+nc6nLGg/6g/NogHQ/jQw+CUNUDqQBkGz6QLoIMqBXkC50BwaDM2lPOhg6Bc0hIZC 82gYdKjSYTQyeJiG0yjoCLoQOlLpKLoIeiHlQy8ib/BzyqfRwc/ISwXQ0UrHUCG0gIqhhTQW WqS0mMZBx9J46DiaEPwbXUwTg4doPF0CnaB0Il0KvYQmQS+ly6CTaAp0Mk2FXkbTgp/SFKVT qQQ6jb4DvVxpCZUFP6Hv0HRoKV0R/JjKaAZ0Os2EXkFXQmdAP6KZNAt6JVVCZyktpypoBVUH /0qVSqvID62mGqiProL6oR9SDc2G1tIc6FVKZ1Md9GqaG/wLzVFaR9dA59J86DxaAK2HHqRr qAE6nxZCF9B3oQ10PfRauiH4AS1U+l36HvQ6aoJeT83QG6AH6Hu0CNpI34c20RJoM/0Auohu DP6ZFiv9Pv0QuoRugv6AboHeCN1PP6QW6E10K/RHSm+m26C30O3B96lF6a20DLqU7oDeRncG 36Pblf6Y7oIuo59C71D6E7obeifdG3yX7lL6U7oPupzuh95NDwT30T30M+i9tAJ6H62E3q/0 Afo59Gf0f8E/0QqlD9JD0JX0MPTn9Aj0F9B36P/ol9CHaDX0YaWr6FfQR2hN8G16lH4N/SU9 Dl1NgeBb9Cula2gt9Ne0DvoYrYc+rjRAG6Br6cngH6lV6TraCF1Pm6BPKN1AvwnupSdpM7SN noFuVLqJtkB/Q78NvkmblT5Fz0Gfpt8F99Az9Dx0C/0e+lvaBn2WXoA+R9uhW+lF6O9oR/AN el7p7+nl4Ou0jXZCX1C6nXZBX6Td0B30B+hL9Cr0ZXod+gq9EXyNdirdRXugu+lN6B9oL/RV +mPwVXqN3oa+Tu9A34D+gfbQPuib9C50r9I/0nvB3fQWvQ99m/4MfYcOQP9EH0D30UHou0rf ow+h79Nfg7toP30E/TN9DD1An0A/gO6kg3QI+hf6G/RD+gz6V6Uf0WHox/Rl8BX6BPoyfUp/ hx6iI9C/Kf2MjkI/p2PQw0q/oOPQL+lE8CX6OwWhRwQFd9BXQkCPCg36D6FDjwkDelyYoSeU BoUlKH8+wC1/BsFqtZKua8bX/1iI6jrZ1Cmmf/OPHYZhGIZhGIZhmHMLm832n9lXmTvFzqI+ hmEYhmEYhmGYcxu73Y59lcH7KoZhGIZhGIZhmG+Iw+EgwzBMZ84Zwdp1sqVTjPdVDMMwDMMw DMN8a4iOjj7LfZWt6+TO+6qzqI9hGIZhGIZhGObcJiYmRu6rzGfOGeE0+6rO3x7I+yqGYRiG YRiGYb41xMbGksl0NvsqR9fJvK9iGIZhGIZhGOZbitPp/M/sqzr/2NVZ1McwDMMwDMMwDHNu ExcXh32V2XLmnBGiu07mfRXDMAzDMAzDMN9S4uPjyWw+m31VTNfJnX/sivdVDMMwDMMwDMN8 a0hISJD7qtP8UaquiO062d4pdhb7NIZhGIZhGIZhmHMbl8uFfZWF91UMwzAMwzAMwzDfkMTE RLJYzmZf5ew6ufOvsziL+hiGYRiGYRiGYc5tkpKS5L7KeuacEeK6TuZ9FcMwDMMwDMMw31KS k5Oxr4o6i31VfNfJnX9NIO+rGIZhGIZhGIb51pCSkkJRUVG2M+eMkNB1cud91Vns0xiGYRiG YRiGYc5t0tLSsK+y2s+cM0Ji18mdf53FWezTGIZhGIZhGIZhzm169OhBVqvNceacEZK6TnZ2 ivG+imEYhmEYhmGYbw0ej4dsNnv0mXNG6NZ1cucfuzqLfRrDMAzDMAzDMMy5TXp6Ou+rGIZh GIZhGIZh/g369OlDDofjNH/styt6dJ3s6hQ7i30awzAMwzAMwzDMuU2/fv0oOjrmNH+Uqis8 XScnd4qdxT6NYRiGYRiGYRjm3GbgwIEUExN7mj9K1RUZXSd3/vbAs9inMQzDMAzDMAzDnNvk 5OSQ0xnnOnPOCOd1ndy9U+ws9mkMwzAMwzAMwzDnNnl5eRQXF3+aX57eFf26Tu7ZKXaaPx7M MAzDMAzDMAzzv8eIESMoPj4h+cw5IwzoOtnTKXaaPx7MMAzDMAzDMAzzv0dBQQElJialff0S g7tO7tMplvJvNIlhGIZhGIZhGOacYsKECZSc3K3nmXNGGNF18vmdYmexT2MYhmEYhmEYhjm3 mTp1KqWmdk//+iW8XScP7BQ7i30awzAMwzAMwzDMuc2MGTOoRw93nzPnjDC26+TcTrGz2Kcx DMMwDMMwDMOc21RXV5PbnZ759Utc0nXy0E6x3v9GkxiGYRiGYRiGYc41BOkwIgcZ6pv8HBRF Gvxe2EJV03xaGQyS/H1/7bHg++GjSpVrx3vRtHEjRwwfNjRvyODcnAsGZQ8c0D+r3/mZ5/Xt 0zujV7rH3bNH97TUbinJSYmuhPg4Z2xMtMNus0ZZzCZD1wT1F4GUgtK13SxZaenp6WUDwvHU zvGA3sf5WXqA4jtlSjulUPdT4j1Oifdsj18aIFegOKOgUFa8looPBCghIFwBklcRCZfgSuFC RdWzM4quCnQrqC4vR4nCDKcnUHwoO9wUVfdau60go8BnG9Cf1trscO3wkLd+rSi+SChHKy4a sVajqOgB/QPxWQGtT5G02QHvreVwMgpRE84knDzTFtyytOMpQrGIlxDyRMBcELCo63quCngr AnSrZ23/LS1L25xUWZ7lqM6orpiBkatAG9eS3qeodpocxyJp5bWegIHKlaQhxVNU62nJkMNR VFsOzShEqS7TkWwtKP1R+pa0QDzCokBcVmAscoy9YX+a3lKUcpVHRltafuQJrLystOPZdKll ZWUpaHBLUQYqRGVFs8egKynZA/qH+hQegOry2fKasytkO4tme1pu9am2LlVtUFmLajExFWfK 1dJSVJ1RVF1RPSZUe0HAO00FNG16qeoghq6wLJwUzoAzhjpTXliWHhrsCVNKC2TDMioK00LT 3p5SHk5BQlHkpEe24GJUEPBUeQI0pTQDWYdJ8Q2jlqphavGklwmUmnyyVMDUx5nhafmCAqI8 4+OPOqdUhFPMfZxfkHSLM4rLW1qKMzzFLeUtFW3BxZUZHmdGy9oJE1rqi8px1cmlKNUW3HRr WqB4aVnAWV4rRmDs5QoonlKan5YeVxaJTo5ECUsKC8uuuoNRwNfF4QCjTNNK0z0YqMtLy9Iw TqXSnwY/FMqFhIU7DHMcHjY5Rr5h7cNTEHbT0+XqvLXNS5WIBBZfVhqKe6gyrZW82VmYj3J5 ZkvkTOLl8sziyJn24uUZuMp69UhKDET1bf+KdSYlFNWOCIikf3HaFzofSCgo1dO0spCnpenS s2XhTh8VSM6Cn5nVgknYmRFwZgVMpVvSRpV5nHF4AsjZm5ox4bLppZ6ilvZVEEoJ91SuAyz1 jIralvCtJBd916kTpkYGXK5Y3NK3YsQXV87GosFXxVL5+ElvcQaKv0xPS2+Jy4j3DM+WTdUK ppV2vGrkwdS5JXj8jFmbIW6+bK1X3Dx1eulGJ57vN08rbdWEVlA+pmxtb5wr3ejBI12lajJV JsqIR0ZoglzzrVqUyp+2EZ8bi9VZQyWoeFWbIJUWFUkTVNWmhdKckTQNaUYozavSJANo7TQa HS+aUMQJ9cKWwXTKF9fSLGULEfOKeesyB+R528S81uS0vDZxzTp9RPqy0aniGpQcBJ0Mq4c9 CHsG9ieYmWKh+bBZsEUwI7hFTG3t3iNvI5yq1vgE5Vzamjs47PTui8ovXTcqyR37lLiCPoVp uPr0dd1S5dWnr0tMVGGr06lKlK2z2mRCfbh59bJ58sTM1sSQU9nqSgw74etOiTg1rdl5YSem r3L8rdZo5VREHF9rbl7YyewXdnp40Ehfa2o3dyjrpMvCZS7KDzvdQheoWJegmluxzh4tw1mt mTnqxKTWkukhZ93wkXmDRieJSejlJIziJIx2PXQxTMM7QzXmpRreTug+6Ynq1vpqdeHi1gRX XshJSgo7GA3pjGmNk0O7FY4tRqVc1JqcopwLW+1wxCCR7bXnuD84WO0+uHuQ27NZDMc8Dkf9 w1v1FPdomxgpcshJbjEUYTTCISKn1eXOHu1AXIg8kUsxSB2M0IXwApHb6nR7N4lhWEDDvNla 7PvZ72vevb165+16I9/9+hup7sWvidcQuN8Q9W+I7S/0c29/Yfiw7cK+rXCbhkfYhrescXmT dgu43p6t5+fkOVs9rd7Wya31rYtbV7YGWne27mu1bWk91CpzewufQIfchSK2xF2iTbp81uXa sGf6uec9Ix585vFntKEbE93ZvxGbn052P/V0kvvppxLdmzZOcW/YeL77yY057jbYxiHD3W1i gXdEfo57FOzC/AvdF+Wnuwvye7jH5E9xj4Z5YflDctw5udXu3CGD3UMGT3MPHtLTvXPwvsGH ButtwU/Wre8zLq8tuG/demcGwk+8MeutsXnrU8e5d84V+65RvbHeIxfpNeheW/C3Xmt9PBbF PKwMeS51rjU+r/5e4a1BsXr/Yv9Kf8BvPO57xqd62a8apebduehObd4yUX+7WLT0waXa4pWC KidXbqnUvRX1FZrzCs8Vy67Q20SD90lXjrvWNc69DjbAFefu7+rjznINd/dzJbj/lPlppvZK pgz0TJfTvcJT4Ha7errx4eL2uEa5H0yd4k5NG+tOSx3lTkU9iSiX4BrtjneluuNg9S7hdY0u yCOziBX4yhb5Yp5YJB4Xz4hXxKciKGyxJGIpm/JpHi2ix+kZeoU+pSDZbNah7lgtVtde0V7R g1pQNxzRw03GcF0bLmj4ZJNoQ+lA/ASaMG1MIEEgnDpmrTUna0KgesqYH952W4/AcvnJuLhH WVsU8uAjNiBuLwtEyae3cikLLGjA14KGgF4UMBfVVgTMGYULZCRGRmLwQhRTFIiVfmxGoQi4 imoDrozCrAVZHUEdYSdMlvzqcIquzeqKBnV11YIs0ZBFKKVSVE1SsiLSfqGGrmsKnVUdysJz tqgWgo6o3PIC+Fg19zS7TIdMu4xGY6a+GzcpBT8IvnviuhPVJ8r0+9Ufvl1Oq2kjPU8vt28a NtOzKlxIrbSFXuy0M/k+3UWraAftxXRFuIdW0K8oAO9ueE3CLxppmUp9iH5Jj9E62kTPnXHP 8wfRI+w9p7lEqAV/IYe2SywQt6Pmu2kMjuc7lLiZFtNwHN8AEdQu1vO16doO7RZtnhb+Hyjt BvRui75bf4Qm4thCr9PTXRT+vvhKfEUN9GeM23bxU+15WkOP0A/RnjvQ64cRm0c/oh/T/bTy 1KLmFlOc8VmnpDb6Nd1EM+iPGOmtKHETTSU5kndAm8hGqeQ2lYfzrqZffJPe/jcwrtSewGjd pb2kj9E2awE9WzP0zeIOrLejukHlOMrQ/okYBz9NwHisokexsppU4aVYWa10O9aH5Boc99ER +oG2GvmvpWv1B/QLcG4zXUiV4nsiCqWH0waxgt6j6Tjq8cB4TzyH0UdJYzPVYrVtNvZaUiwf 0Sy6DLZaPGlsML1GzVQH2wrV5EumBe8Z+NC0kOtJs2aQtOyX3n5JyQWD0uPS4/pABHIdXWyi f8iQ4GBh0H6sma2mXar0dG+srmua+XJTFJUbWXq5ST26o51DyeQ0aYi9sz462jwSznvrHQ7l vPWE3Q7HipxPxiCj1WnVZmZl406dmbX/+H7K/zg3O/+CQULP0BMyhuSKrd1X9Xx9xw7Trn+8 YAw9mv0H2Yb5+i5tq9ml2tDb69LMZrJgi67rRn+yOC0ei27Jnol6Pqb8UbnZo0K1yUPbmnVj 1gqY2XX8Ka1Amvw3hruJTHeiTw7R3ZtcYhPDtGGmPNs8bZ6p3LZIW2Sqt1nxufXZetlyA453 uPQut5bYptv1hVZhsmm6VTPijfONIUahMc242rAYnuhobaRhWOxWXViirDa7btJc1Bb8yBvn cGgjyWy3QzWZC6kH1zudZul8uD42VjlHvXY5ZOSQI4j4AW+avCr5YmJjJsdoJpusRSpGM8HS FjysaoBzYr2sE84Rb5ysy2KSeSy6rAep2zbIaizV0c4vQw/OjzH0ER+xuOThGLb8UfHDs7Nm xicPx+jNnI9n68z56RlxIkPEZWBliHTTnc+faLzuxKKNIkY0iBqRYNKP3a1fdfS4adex5/QL MUsjg+/q+zFL3aivyFxrlq//Xldqby0qOdmVQj3HuAwR1XtMlA19+9LrUn1NThVO2Qthlg0X slMyHc4+by/ZbCEyz0uPUXliXDJPjCoYkyQ7F4PV9aTMFROTeV6cbL/kpYi3ZctLWVhe+fiK y82Jy43LvWBQmrdfpldOxAj9Qs/gXiP6TvIU9rq+uyVVi0pTrRwdaSWaJkc0QY66SCWPmj01 ByRfYXqreZyXmZ4WkxQbq42MURliUmWGmFR5Mqb+vNAof6yC41mjRrW3Bm1BY2aKrLL0jCFm s8VszujV97y+fYcMzhual5ebk5Qcl6vH9e2b0cuc6ErKzcnT92/u783KLBl+xf15Q0dNLLjw 17OmNRZt3lw8b/QdDzXfOn75/D6DXAmJEy8e/+Ztd74x+eKpfc4T+48e027slfrmS7/bpVb9 zbiV9hgzKZ5WeNMo2hntiR4UbTissUSLjB8bmlFoizVZo9C9Lets8UNl6I1VS5BcDkuU7BmW 09ENanWl4oY+5I1zOrWRVrWmrYYcAKQeU+sSzgmvXc6Y1SELIL5dLUTr3IT2xXc8K2tUXC4m i/LzRx2fmZONqZPDkqF6bsHKy00MDYe2x5aYnT5xecHmzTX3juvRI16/06yPGX3sA2Pmqism 6Lp8mrrDRwXd8t848Bp/Fgc2n6c/Gvjggw8++OCDDz744IMPPvjggw8++OCDDz744IMPPvj4 3znU//zL/5R3QeV/uUsup7HBLxH2Ec/K74A3dNLIQaR8E3wnDumbVbpH+RaV3l/5UcofpXwr ylXTxLAvkD8Q9jWKEdvDvk6DxKNh3+iQx0QpYk/YN3dIt9CRdj+K+oneYd9K3cWhsG+nYs0R 9qO1e7Qpyrd16ItdttP4UPmODukx0jeOKt8p22myKT8BfrwpRfmuDvkTVX9DflKH9G6qbD/l p6lrhers0SGPu4PfW+Ufpvx+yi9W/gDlT5N+VIf2R3W4lqNDuiPSl0tpHs2nOqqgOTSXrkes kq4X0eSj2Yj/BXby/FRqQDgXc1WBtGr9Pn2t/pT+DGyjvklfQ7/EPOfQIBzD1E88XEVVyDeP FsD8KOuhAlVbvdIKpFwFby4NxJnRqH8OwvlIq6FanFugYj6EPoQLodXIOQ3lalFKtsiDvDKX D2EDUmU+j0qX5WrU2QaVKst64MurViNWp3pwNdLmtZfp+qz/rHoiWzRX1SVb48FdMle1LXT9 0Pg1qD55wiOZHW7BvA49qELsWpxtUKMhcw/ssg2dx2KK6vO1GEXZ+hJV14L2dg1BHYMoD/XI FoSu9V3VD5k7NEq16kw9jUCrsnFWHgNR+6lXHqhaWIc8DVgxcgxq1CjUo4brqUy13qNadT3C a9UMhsYkNF9+1aYGNQYyXq+uXqdGKjJWlapsZByLMJITsUZCZed3OFOvWlaNq1SpGkPj/111 rSpo19cNxWXeKozXtWrWQytkHrRana9XI3l9+0yFrnVVuIaqcF0+pXIFn9pveX6O8jJR6ny1 TuvQr8iVumrV3H+q+euP0cnaq1VNNe33T2gdVbWv0q77fnLldm7XyA4jIHsS6kuDul5k/cv6 Q32tRsp3Vc/nqbup656Gxrmi05j6wvfBqXeDHFW5Kq9VJWVrF6re+NrrkTnnIMe/nqGTTzr5 LLuqPf6uevL5Oj0JfZ2edeppZ/Q0LjAmGGONC6HDkbsC7ZA9nBtqrQiIn+ukxn008s8P38EV pIe+Cy9YQktO8w16OoU+DUUw2P7TZKSVaFcitQLexSS08doM0rWZ2lL4t2n3wr9Puw/+/dr9 8B/QHoD/M20F/Ae1Q/D/ph2B/5XuIKFH6/gs1uP0bvBT9VT4aXox/LH6BPgT9Rvgf0//HvxG vRn+In0Rafpi/TD8L/Rj8I8bOfiMyTVySTcGG1Xwq41q+D7DD7/GqIM/17gW/kKjCX6zcSv8 pQbaadxnoJ3G/cbD8FcZq+A/YjwC/1FjO/wXjRfh7zD2wX/XeB/+fuMT+J8an8M/bKANxhfG 3+EfMb1PwrTfdJB0019MH8L/q+kw/C9MX8D/0oT+mr6y4FqW+y1/Jt1ywPI5aZbD1jEkrAXW caRbL7auh/+E9Qn4G6wb4W+yPg//99Y/wd9n/RT+IWuQhI1seFexRdmi4FttcfDjbfHwE2zj 4U+wTYA/0VYGf7ptOum2K2z18K+xXYP0+bZb4S+1rUb6r2y/Qsoa2+PwAzb01/ai7TX4r9sx p/bxdrxv2KfaMZ72arsffo19Lvx5dtRmv8Z+C/wW+21Iv91+J/y77Mvh322/F/599gfhr3RU 4LO80uEj3eF3/Az+CseDpDlWOjbB/41jK9J/Fz0Va8oIv8Np1AdraTxWyARtAhnaRO2S8OyH 5tSE2ZwNvRpzqqnZNBk/xTyaMKroi+XXlgAZlrWWtfDXWZ6Ev8myGfqM5QXoK5bd0D9Y9uDs m5Y34e+17IX/R8vb8N+xYJYt71reIwMzUhwe/8j4vGh7Cf7Ltl1k2Hbbdqu+30qGfal9qeoj RslR7agmw+FDf4Vjs+O30GcdzyLlOcdz8Leiv4bqpY1uFwvJVDG/opI8VdfPn0MX1foq59PE ORUNc6m0obbiKty9NhKXTyn04L2WcOdp6ttOQ57AHWmou1bGNLK2x+TPe6LclEmXnCxnICXk mfBGebKcfBuNrquYfzVNVlqqtFypX2mL0hVKW+uurrua2pRuUbpN6U6le5TuUzMYmclQKEh+ 36uTEtCeREqiZEqhbpRKadSdelBPcuNZmE69kEf2yYRWRaE/NrQ0+jRpQr2pyn7rncIYiu0y jKN4yqJSKseTuJ6uo8V0s/qu8pX0KN7A22gLbaOdtAetP0iH6Ag2EVHCKVKERwwUo8R4USrK Ra2oFzeJ1aJVbBLPiu1it9gr3hMfqvkU4j60EaF9M1qKMMYVCmNPhNa1c0Uo7NM7HH4ZCs+b Fgozc0Jh3phQOLRfKBwWEwrz7yJsYEh4e5IZQyouTSIzTojJ80Pnp/QnMwZZfKc3meXP75S2 htpVegDjhnD69FB8+k3hcFUovMIVCmdqKp8xK2ZWr1l5s8aHY22zdszaN+twKFYeKN9avqf8 o1CsYnrF3IolFctD5SunhMKqi0JhdYrKFVX9mc/s6+7L8Y3zXelr8LWo1Fh/vf9G/z3+Nf4t /lf9B/3Hapw1vWuG1UysKa9pqLk51OLaaWovJ2pvCNVYuyQUXjUjFM7eHgrnUChf3dxwuFDd HaLuMdy9hdblahexV/6+3cYW2DISzQcRLofhE6n5E6LvvQ7/F7BHYY8R1a1HKG0T0fytCLfA noftgO2G7YG9g7KHEe6HfYh8ss5DMOw4G4+FrAkT0YS+NB9FGIM8mKkm7FDnFhItSAmFTakw D6wvrD8Mn2KLMKFNw5A/E+FFqCsPhtFoHBO6dlOhltq4pPmiZtecE43bmxuarmte0dTS/GzT o80NSF/RuKauV9Oy5mcb1zSPl37j0821jVub5zYtR54Hmktkujzf5Gi+R1lPxHsi/WBzQBr8 Z6U1voXysKZBYTuG9GPNB+rXNBfWy7pvbi5svB3hdpSD1Y1ontx4V3NJ0/RQvjoD7dnePB7p hbDxp7TnhqY5dZlNKXWZja1Ib0X6TuR/HX6btLpekfId2rlCtbVzfEV73KH8FY2vo96eqHd7 qP6mMegTDHUraxqHNkq7tC5J2WniyLtCWnv8IPxpzSvQl39p7e2ZDr8clgJfmh/+HJichxY1 vg1Nj6n4NsRLVBznMYfPKouMf2g+DqDuBjmO8D+DHWlcgj5Ka1NzfSAyfk3l6LMjbD2bV7f3 Ozx/sG2wEjUPT2MerkO+eNQj4x3HXl67N871w7m3UIe0NajjHdTxYd3ApkOLkmT9uM5Aac3a ol7NUYsym44hjEG4rHlb431YIytR5yqEq9RamAwraV8T4bUTsUgbT10Dp67l9jXzXvNi9O2m f8rfMX6wU/mlKP+TpnjMR7yalxXKTo23rzE1hiWnrLmS9jn9p/yh82jTQwgfauoN69f8UGQt tqcPQjwPdkrYfg+O+dcWmdP2/F9zTXexxjdIa49vx/rb3mEt56FP0ubDl88Z+dyQz5btza9i je7F2n0Za/dlrI19WOsb1HOoRZ2/B+c3N/0Ccbne14efU+G13r7ml2CN7W7+qM55yjPnOsSl RZ49m+BL2wIfhnIHlL2l7puSyD0Tyd8eP5k/cr5E2mnjzyP/8yfvuaY9aPeek3E89xrks6+L 8wfC9+g90tT6W9N8A+7JWozvDXIckCbX9TZlO9vXrbp3T3mGlbTPb8Qi98hbp1gk/ZR8uAe7 q3v95LO4Fuk3dHgWjA/bNmWnWx8HsT5gHZ5hm/GM2oy+nois5fbnVWPzsMa3sI5HdVjH8Xg+ fIn4muYZsMrIs1/em8o+Qfww4mvqijvf34jL+/uoekadGu+Y/x7kL1HnpB3G/X60w2dE+DPh 1M863JercV/KZ+Nq9QyL3Fsnx2Ghski/m1FHc4f74Ub4N54Sb1afw/KzdTz6Xosx2dAhru6H 067THYjvUPGXlYXXNdr8GeyIeqZL67nIgNmQ5yFlbYuc6tkfHpem/aF11kRYl2b1HAx9NnyC cTn8T58lDWqeIs+R1/+5/3h7ilY7dVL78ii1I7eqPXGM2g3HYh/8KcUbX2IHnKD2vonY9R6i VNPn2Pt61K63F/aRl1EftSOU/wqcon2q4V1JN+tm7Nxdugv7+iQ9GW+43fRuZNa7693JovfU B+F6uXoepenfx07frR/Xj9OdelAP0l3Ymz9KP8Wu/B1arvbgv8TuezGtNi0xLRG5phtN74vB pq/MhrjLbDZHiZXWVus68X9ytysexn62RKyyl9rLxGrsT6PFGry/f6RddPJNsRpvYzUlJGpm IKyE1eKNFm9q16yCPxfWALuBqApvlFXLYHibrFkMuwm2FPYT2D2wFbCHQmVrVsMCsA1Efry0 1mwOh8/CtsFeDud7FbYXti8cXxoOD8A+gn0Gw3zUnAil1+Ktsha7u/lmmAMWT2J+CsKesN7Y b/WnEVRIl2L3U0lzsKdcTC10F63AzqeVNtPz2PfspY/ohIgivUqrSfKNqenuG1fTi7SqlJrU qt41HngxNc6q1JokeEaN2bevxkFa5VH/Md9bNdh7VR7yf+bb4z8B74D/oO9l/1F4b/nf8W31 74e32/+qb5N/L2m+Df7tvoB/Jzy8+ftW+Z+H96h/g+8B/2Z4K/xrfD/xt8K7z/8L383+R+Et 99/ja/avQC1L/at8Df674C3B2dn+FjLkGd+N/od8Lf7VvmV+7Po7xirL/RuQe5q/pP52/wx4 4/0TfTn+Kf+VFW1S/yJF6t+ihOUjy+dk/X/sfX1QW9mV59UDy2pMs27C0ISmMbYxBoe4aUxo wtCyLAtiCwwK63EcQoPQ1whJcdteljiskIS+kJ4ExbAMRXkYhmUo4nFRHkIYhrAM5bhY1uN1 MR6GdljWQ1EMYSiKcbyOl1COy9lzrt4TQtBxz9RM/po69XvnvKv77j333HPPvffxfE3fkbxD 33Z8CfwrVmCnfzcah30oUcHOQBcPSALAvvfTEuCw2tedBOQQUgO7jJosAKz2dfkACaAIAPm0 sDPQwr4eWkJ0l0GGXYOuCqABGABXAfUAM8AO8ECeSwDwT10roANwE9ALAH/WDQKGAWOgB9x/ CvefPgjU8ekj8pWa0ppz6vyac1f61ZKarJpzQcqtKaAkBSpQF6lL1OVwLQcqURdBSrnuIPKa Al28Lh6vNQWfpn968tOcT/M/xXNBYqEXwJeZF8z/IwzzS+iRSNojQtoj+2mPRNMeeZv2yEHo kU3yDu2RWOiRp+Tdfc+gX96j/ZK075f7fkmSoV9KyaEDCuidVOidbpJ2oAf6KOO3Xp+ASEgd 7fGTsJ8lSuhlDfSmZpGQ6vs78d1pIqp+qblX/UJzn9LMd5dAXxHzC+YXoO8ms0kEkb8Eb2T2 /Xzfz0kEeOAmidy3BX6470DZgTIiPPDHB/6Y7P8XPSOIXftSPokg0YJJiA7kmoowvljgegBE umsQ6a5BpLsG3lMNe9hrbu4eAZHuWnvIPaKLywO4ghGzh0LgHCOMcS4AXwIFlsnL20gmTFVf WFoqYapTdufFNB4h5fK/kWv9nE4Qea8Ncbo0cL8N7cgf0HV0Rzq5BhH6GkTna/c59PwLMAOY o/YItp8DubYQ1J/WzyGgH9pwicMqhw0K5jqM1mvPgY8xT6pnHdHeG0qRI1Y9U73uSPBazAZH stdpvupI9bLmescJbxukZ3kt1YuOXG+n2ewo8HZDutTbZ7Y7zqnnPplzlEJOj+Oi9xbkqfB2 Qn4llFPv0KlnzK0g34HyTSDXO657R+Ca4G0zd0DO8epncL1rvum44Z2GdAuk98L1IVyd6iVl jIP1zpoHHG3eefOgo9O7aB52OCFlzNHtXTFPOvq868o0xy3vM9DhjnrJPOUY8W6aHzjGva8g 5S5NmYaUR46HLKNMdMyyIsg/z8aYH8M1zvzEseh9Zl52rECeNcc6m2h+6njGppjH9NNQ/gvH pnrD/NLxik0DeVG90UicDJvZKHSK2OzGaLDPjcZYvKLd2LzGBLRYY7IzxtvZmIqWbDwB1/HG NmeedzZ4FcO1k17bQq7dThl7qbEP5BW45tEryrfo9Y5TzlY2jjgV3k24yuE67rwE17vOSlbU OO0UszFwzYNrn1MF11tOPU25QlPqgqUF5FvOBrhOO23wa5YzjhU35joTWVnjQ6ebVX3COP2s 3upxeXwHGwucKdBGKW3pOdqiFWc/29C47rzN2hpnnQ3slcZnzhj1UmMpzXORWqDUmQZyBZWV 9KpzZnq7G3XQX92NJnq97sxkYY9Gywy9WqjFQq+bziFo6SvnqJe1MN81sG6LyDnB+i0xznts oiXOeV+9BLIKesQJvaBonHe2e+cbWWe292HjIljmCqR0gYbzzh62zpLoyGLbLSlOlXrVkuac YeXmeucc22XJhN7vsSQ6F7wWS7ZzybvIySnOVfQ65wb0UQG20ZIHv87iqGH70T/Z2xaxc4NV gGemQvq8IxlkGDvsEHopO2oRowUsMrS/Jc5RCtrKnc+9mxaFcwvkS87XKNP0S65IkCuh1Z3K FFcUK7JUoi8pU7CXLYmug6iPK56NsahcSd42i955D/JfcU6oZyx1riNsJaSne0csDa6T4Mkw ytgu81NXDjthUdER9xTKSbHYoMxxi8yVD/q4Q2Q/lPnQ0g7t7bN0uZJAnx6XBOR+8I17ltvO Vfa+ZchVxM5YRl0lYIcJp8o7y1npHlrJcp/KE/DUrGUGxilrmYM8K5YFaoEUaoElKq86e0De wKgClsG+eE7lLace5NfObDbPGonp1iiMOZY41AdiS5a303rQFaVessa7yiEKTeFYsCa5LqPs qgI5NP2I6zI7B+kadsKa7kxhF6wnXQZ2yZrjOMeuWvMdd9kNqwRqXLIWOUpBLnFMs8+hlgR2 i8aK16Gy5TnYymItd9axMfpbKIPmIIOdTWBniCHsc7Ah2j+Gt7+3zXoZakyxVm3b2apB2Vru ymdjrAY+HcrpcMb4IpVprqu+KOtVV7132lrvMrNpUKbd+9Bqhr67YrVDSzetVzFaBn4NlW3z KNsWm4fwKYyiVrNr2ddRve5qZduh5A6sxZ3lHTePuXO9K6E+3FjQPOq9YVvBGAU+zHmvvxS9 l1VYZM0T0F/Uz0G+512xreOIBu9VoJ0dBf6LGHv9FRjt/UoaY0dhrFWgxzbfh3rtjgq/Tpmm n4Z0N0Z+aPUgxFiI9n6T7ZmT8XWE6gxyLpUf+zp4T4bIPAFtuem1gM7dMAvAKPPfonrewbb4 r2Nb/Ddsm80z6iXbK5g1xmEWiPWX4gzit+Ac53dSubSJcW6oZ2w6BwQ7SE/2O5tEILfh+PV3 4izD3qbyOZT9Qk4egPQNmLNS/d1NoIO/L1SHpjicK5sScVayPG+e81psJ9w31KtNKejDVo3j hHqpKc2R6x+xHnTc8UkgHfy5KTOYPo7poBvI7BaV76Bt0YcdI+zzpmyIdXMQQ2Cma8pznPPf tcAcx44GZPRnfyl6MrQXZj1/BdhhwV+q7G9e8k/jHA0liyGdyuxGk8wx7ZtqkuOs3aRwn2OZ pktUrsS5Emdz/0OcN/2zlvs4pzep3BWsCOd3/4gyzjHrL6XyOI4OnwRlduuTK3SkqGCMt0F8 q4Ra4ppXwSZ6Vy/bBfIGyFeaZTDbwqjx63DU+OepvBiQm+oc11l/U0OzzL+CqwVoC8zL/nUo E1YOTbbm5xDzVc0LvNzkdlwHS/oh/zrYH0ZcU7tbCDM4+Izfgj7jf7YtfyLb9iX/Jq5AfJE4 1/vvfJ5sWWje8t4FP5xUY79X+F/hqqCFCR1ruHppEeE6oSUGdIA1TFOXa1gNbYd+b2vq4WTw 7aYe9zz6NsRJLtLiOsdvwhWFby1U5jyhH2aolKbbOLqbhlzL/r6m0ebX3tmmCRh9m+YBV693 HkbEgC8e5EGIY60Qf1asHVDjEqSMeec/mXNN0jxTELtuuh54FwMzlLXX9ciXZB1wPYYYBV7t HYH48MR3xDroivelw1PxsOKqh5F4Ep5dg2eHXU/ZLuuY6wXUNeV6CbWb3QQiLYxr9Zw13xUP tU+C5d3WQXe0L9065Y715VQvuhN8+cpEvQ48ZN2djGtLdyqU/MJ9wldk7oA1Rol5oDqBrVOK XMO+8qZ7uGKxmTyRLXHmXpcHIsAD12XfZfNTd4GvylzvlsIsNukq92lQZrugzHMQDURQjsH6 yF3qu2p97L7oqzf3ooUbhe4Kb5/1iXOBvRS4Nt0H+8w2zXiivHegf+/CmJ3zHGxJbFrwxLek NC15klrSmlY9R1oymzY86S3ZTc89J1vymrY8OS3iptee/BZZID2wEoBoCSs32zquZyASwowD M1oCXTPAGgxmLli9wNwNKy5lpqO7RW6P9EhaFPYoT5F3OrCixrWretV+0JHVckmJT722XIEV 9UxgLsZVNJuHsRTyxHtK2DyYNytBToK2vIY1z1JLpf2Ip7xFZU/3XG7R2096qlqu2HM8mha6 zqGaQP7qRY+hpcFc77kK65xKHMtQ1xKsGwvAGlwr7PnbLbJLtlcs9qJt2bbuqceWesw4z3Ky HVqdyLWazozbskXlnMBViuuId1PfBz7GyRD/EzD+o2WsVQEZ5xTroDOlxWZedj/0z4OewXnf 3OHxQKyo97R6R6AfcT0GI6XF3Sj0dLT47SW4Rm3qcbBg4XJndku7ZdVz07vSVOfphRHX5Yry dShj3ErvrDLOrfPOW5f1uAcZgDXwPNRl8pnNa+7rMF8Pu2+wt80Dbot3HvI7Mb8e9h3WNTfr s8O1jV47fXZlmrvb57E+dff5Wq0v3Bb1KqTcotdumOleuO9AjdnuEZ8BUsZ9UVAm7kTgCmuM l27YjzRufhLn3bQR90NWbhO6Z30aWzSubK0l343y3bQOuOfZLluse9HXa0twr/gGlInudZ8k eL2Fuxg91GVLdj/zDdpS9RbfMMw1m+pVW5b7lW/MluucgWuW+6Fv0rzczLDP4SryTcE1Buot aI7zPVBmNif6HsGoH/al071Pj+2EcwFKkMLc9Nja2pzie2Q758j1PbGVNqf5BmwXcf4N7Ixs Fc2ZvmWw0nWYhV+4X6k3bEr3CKxAdM4U2CUJYXXXF4hj9PrUZmrO9r3grteb83wvzcPNYlZk uwFxmyhj9Dq/0GZxKH3DyrRmuc8D12yfx+ZsVrAxysTmS5CTba4EDduaVf5oZUyzXr0AGl5h R3eU1tlc54+1dTc3+BOonGzra7b5U223mt3+E7Y77lx/lm2k2e/PtY03t/sLbHebu7ydtunm Hr/U9rC5nxU5iLeitb5x05vs3bRPeRO8r3CFACuQKc8A+1yZ6BlkX8OK2tDSZZttvu0/F7ja L3uGW3rsVZ6xln67xjPZcttu8Ey1DNmveh60jAZ2x/Z6z6OWCbRzyz20Sct9u9nzuGWG29sG drV0Pxu6V+V2qXR/ard7nuzcpQb2oXaPZ7llzt7qWWtZsHd4nrYs2W96XrSs2ns9L1s27ANe Ak/RcuyDXmHLc/uwN7plC+uFkqHeltdYb2tkcB99F9Jh/dAahZq0HkRNWuO3NYF00KE1KeAt OBuymbg7DuyLW4/gGgzKpDtr7KPWdFwdtZ7EcdSag+OIvc/t32FV0xplH3N0tuZzpYF3tabb J72xrZLAG4ngW4Jo711ca7UW2R97T8AcHXj/QHf69iferNZy+7I3t/Uy954hsKOnbxICe3b7 S+/F1qtcXzyA1pVwby3oOwp8qrXKvuYt8AvtT73SVo0yzXvO57G/8Ja2GuyPvKm+l/Str5y5 QAj9kixy/x/t/yHZR78PS6Lfhx2m34el7v+b/cvkA/rt11n67dc3ov5X1Cy5eIA94CeV9Du2 6uiJ6CmihhLzSCr5mBAiI5+QRKIiTSSHnmt1kbSRPyC/R3rJfyPfIgNA3yaDZIhUkB+TcVJN pslnpIYskZ+Ra+QfyQb5HtkkvyaNAkZwgjQL8gT5ZEggEzjIjwQ+QTv5BVPEnCe/Yj5hlOTX zH9mGgQRjIvxCN6KKIkoE7wdoYn4fcE7EXUR3xf8TuRXI08K3ov8SeQ9wfvCLwsTBYeEScKj gsPCNOEHggxhjvAjwSlhvvC84CNhifD3Bd8QXhV+T6AWNgj/q8Ao7BL+UODavylKF/yJKFP0 VcGs6APRB4I5UY5IJvhMdEF0QbAqKhf5Bf8o+gNRO3NE9IeiTiZV1C0aZ9JEE6ItphD/usLY o4aifsg4okaifsy4DlgPeBhfdEx0AfOH0b3Rg8xU9HT0NPO30fejZ5jZ6M+iP2P+d/R89Dyz EL0SvcL8HyIA2xnoW9Nk/K6pGFCyCFgBrJNE+VLJYslKyXrJs5LNklcXGFAq5kLchcQLKRfS LmReyL6Qd0F8QXZBfkFxIUW+Kt+4cOlCJX4bRr8hJPu793cTZv+f7v9Tgv8WJFawIFggRLAq WCUCwZpgjTCCfxL8E4kQPBP8XxIp2BRsEqHgV4Jfkf1MBBNBRMw+RkTeYt5m3gZfOsi8Q2KY eCaeHGTeY94j7zBHmaMkljnGpJMvMTlMDnkX+uEnJAEtR74MbZoni7RlsfhNnDyXqOTrxZXF qmJ98ZXiuuKGYluxu9hf3F7cVdxT3F98u3gIMFo8UXwP7vqL70OumeIr8hPyZ/JN+St5bjEj P1cskhcUxxTHFScWp0BqbnFacWZxdnFesVguLZYVy4sVkOcSPLNNuRxNy2cBD7m7ecAdjkrl F+UV8hW5Ur4ob5Pr5Cb5dfkNuUXulLPyTvldSO+W98lvQc4R+Th+afXWz8Ga8TvGAn7hnEOu gmfnk+/DuJDSsVAMY2CIXIBR8GNSCmPgM1JG1oEU1EbfBF/qIeWiXlEv+T1Rv6ifXBINiH5A viX6M9GfkW+L/lz056RC9CPRj8h3RH8h+gtSKbor+gn5RDQn+oxUi34q+imMKQHphtGGVj6C 3xyWXQeMA+4CpgEPSUHZJUWRokRRrrisqFJoFAbFVUW9wqyQKOwKj6JV0aG4qehVDCgGFcOK McWkYkrxQPGobKZsomyu7ErZQtlS2WrZRtnzsq2y12V1ikhFlOKgIl6RVNZQZitzK44o0hUn FTmK/DJ/2f2ye2U9ZaoyveJxWXtZF36Vtv/B/hn6PWLUDmt9HyiH/A3Q18g/AOVCZPgZ+Yis AeWJ/lr01+TrohnRDMkX/b3o78nvEkH0s7cD/2rpBH4PWtULgFarXgEfBAwTgRpq+4Yp4sOq m6r1ql7Vs6oB1WbVoOpV1bCaqRpTi6om1TFVU+q4qgfqxKpH6pSqx+q0qifqzKpldTb9bU2d V/VULab8hVpW9VItryZqRbVQfak6Wl1ZHatWVSeo9dXJ6ivVqeq66hPqhuosta06V+2mvEDt r5aq26l8Tt1VXaruqb6o7q+uUN+mslI9RNN16lGaB2FST1RfV9+rvqG+T3/DvBb1TLVTPUdl Vr1Q3aZaR9D2QFuqO9Ux1d3qvOo+0At12AuoE+oTCtQhFLwu4cD0UEzDTvKWegntUv1Q/Zzm mVVv8XpRXRY1kdUrmiiqM9oH0++ArjxHjKgTdwCf44Ft4YG6rWsOVj/TxFdvQh+gfV6BvdEW 47A7wLrvQh1Y17z6NbUj2gQ49q2SqXiOz6C90A5KEcdjNEnoG2gfnivjVK+UiZojWC61Ldrp ToArU9SZqAv6iDJNk055puYkrQvtwnPUH2yizFbLsD95HtQdfQj6V5mnVijFmhzaRnyO53zb OK6UafKVco1EqdAUBfUU7WxLuK5BztkhaI/JAFdeUscpK9VdSpWmRKnXlKOdaNs4Tvsj5B7H B/oujhFqZwC2n/42GWh3kK8F2h/kL3a3X3lFcznYXmFY+/l7HF/o+1zfKus0VTXDgbRwHszT oNEobRqDckIzoLynGeTtRf3uDbxm7Iv9viNfuL2/AK+ZDLkPtzNnM96HfhOvmdq+r3kQaPfn cd4u4baueRSw05s4HcPY73fDOOfLVG9oD++HvN1rHqueUb/r3cmD/gvjjaYP/mYebsdgPWF+ X/NELapZhpjbue3n1CenApz3e/4+yEP8vmZN3VPzVJ1W8wJ8nPP3IOd8HmMB5guOAY7XvFRn Y1znOc4lNM53ho2RMP55/cpzFVGLsT0852MKP7bC7/mxRucsHHNwrxLu5JiOMYjONeRzuDBs TIaPVeBoTxXOh+gPHA+OS24Mq2JhnoQ5jOdB/+FjXWoYx7KxfiwD84EvqRI0VbTtbs3VoB/5 NfXUT3Au5OI7xm5lu8bM56ExCPxE2aWx8/M+6qns0Xj4sReMazjHYBzp17SGxjPlbU2Hckhz Uzmq6aVlwjzD21Z5XzNM56Aw+ylnNGNoL+WcZpKWzbUN9UDgM8rnmifKBc0U7dtkbbcqVdun OqG9pcrS3lHlakdUBdpxlVR7V3VOO433wbjDxY2gn/D9AWNAVapewnmZj/X8WAj6dFiMUV0E XdDmEN9VFds68M+plNqHKp12Nji/hcfG8Bg3snMOCfflXfNi2PynMmnnVde1i8E5akuzrLqh XVFZtOtB/+Dr5svm/QnnxiXNA0RwLcavx7g1mXJV80i5oXlMbQ9lK19r1oLrNLRTpOYp9eEo zYsd6x5unYT+UnNQ85L6Co75eNgQ4xjn13MYV5O0QhqXj2ija9K1sVRHbGsYak5qEyhytMkI OlbRl1Af4DX52lTqT9x6sEaiPVFTpM0KrgtRzxJtLtqkplxbQG2D4NvNAfu85rJWim3F9tVU ac/VaLSl9HmD9mKorWquaitq6rXKGrNWV2PXmmo82us1rdobNR1aS81NrbOmV8vWDGjbsI2q eZ2MX9fiHKNyap+pWO2mqk37Cv2vZlDbqerUMQi6DufGKI2XOFawvaCvqlsnCvYRtp23Jbcm pjaCOqkdsH3ol326GNUtXZzqji4xGL+x/8A+aKcd5SEPX3eHrrfB1qoRXQqNTVg+50dBn+H8 JbhuRlthP2E5kJ/GGm5fEJybuDWTalyXhmUFYzM3l6pmdWK0g+quLlM1rcumew3Mg36N60NY 86ke6vKwLtzB7/+H/T8jJOrv8N8mHmg50EJw//PV3/L7Fw/5dURJxDXBV+jblm/Sty3fom9b vk3ftnxHmCT8oeAT+g7lF6JM0QdMGr49YU7g/pb5XXx7whTQtyffo29Pvk/fnvwX+vbkJn17 8lP69mSevj1ZoG9Plujbk3V8exLxZXx7EpGGb08ijuPbk4iT+PYk4gN8exKRBfvefnJ7+x2D 2EPOicfEU+IH4kfix2Iz8CfiZSCzeE38FGSz+AXgJZAH6TQRD8NVKJ48HX069nTC6eTTqadP gJx1Ovd0wWnp6XOno8WtcF96+uLpitNKcYd48LTutOn09dM3xK2UOoBuUuqlNABSKwXKAHxf sH8Y+u5A2A64AfqukVhh73sH6Ot0N5xP/pbMwn53DuhjwfcEN4gY33kRCb7zgicF5DKpCmnv TXKE1tYLGBAPQmsGQRoTT0KbA1ZAO2Db16DlL+H6BNqMfI1aYeC0EFq/RnX8K9DxXdAxFXRM AxKQdCAGdtx4EkYmUCQ5ST4g+8iHJBt24V8jeeQt0ElG3iZFQDHkHNB/IHKgg/R/gHmHlJIy 0PSbpJzEgXdeJvH0X8onknqg94gFKInYgN4nD4GSoe1/Rw4JYgQx5DARCOuF5u226t0RH+rd ev/Zi/p2abmkQrZ1NkHCStgzPeLsM0Nnk8XZkgoxczZaojzTJV0+06Xvkl4Vi874pcvSYcn1 8xZ9j6RC3w95Y/S3z1vOiGUb8IRTP6QfPRMjFn08ft4iMeknJH36e9IxqMetn5OWY6nwfAjp F/Q9AToTEyAshafzFo6yZKvi7Np6ibN2AMsC2VPbqr8nFund0nIEtIANkDgbKVA6libOkyip 3mP69lozPHFPUlFrl23p+yWsfsHAnr0ouY6AFrmlywap4Zy+HeR2Q6nhIpSN1hDzQP0RqOPZ 6DMxYJ1kLN3QZug80/XxuHT5vAWBtSGkZt2k9AmWy9eCJfJAHRAGsOPZBCg/T5oP9o/hoX9d GwU63j7Tc94izjboDCasu7aj9ibWH9DBYKGtC6kbYbhouKXv0k9ga2t7UeKBKfgk5kK9/jkA nVdD9Q/DKupsUNbG156slfAahmKv9Noc/Uzt1W3NQ4HphkXayxTaHtNJcfbH01LzR1l6N/it Xzqsv6+fMSQbUvVz4EnYb0vwTIJ+y3DivEVXonnG66fr1Q0Ysgy5UrOhQFKB3h6weSj0z/Vb tZEfFWA70OYIqaf2oGyrNh6QZLhuuKF5pr1/Zki2wYP3iNojBmdtupYJbx+MkSFEwFtqyxHi SqgDeq32cm0Vcl7GXjR012oMfbWRhju6l4YRw7jhrmHa8NAwG/SsLonJ0G2Y5/tTelXSh0D7 BLyuMN6wYlg3PPt4HHLcwzEA47WvdlA6XDsMklPWJbkOI2GsdhIsPFX7oPZR7WNo3RNpzhkx jn4YtyNnL9Yun02uXYN2Pa19IS2qtde+DIwiAzEIqZ7RMMbGCuMDtdYWGWI/HgHddPoh44bx uXHrLDG+NkWaokwHTfHoO2hT3u8+npatmpJ478caa/NriyiKTEf0twMl4G+m9I+oz4d4IO1N foRsjwO0LrSUs5Ip56MT2KOmfOnY+SzIo8enaW6wk2Hz7EXDKyNjFBljjHGgz6Yx0ZgiFolF 0mFjmr5f3194xJh5dtwI49yYR6NS+5l2cZ5RbJRJq4xy6PFOo0LiNF6SPjJWSqYl00ZVrd2o h3yyMynGK9oFY50xTaI0Nojjag0YKT+ePm8x2mAUxxnd0jGj39guuSuOkZiMXVBDj7HfeBv4 kHEU6pzAX4z3jPeN92RbxhnjnHFBtgWRs1TaanqKsVZ60yQxFZ2RGZeMq9Ic4wSOBMl1iB5d phJTubRIOgw9WIHRWD9E4ynEYoh9/aarpnqTGawm1g+Z7CaPUWZqNXVA+k1Th6nXNACpg8ZR Y4NpGH4ZM03WliCZpkwP9BumR6bHpiemZdMajLnlM9mBPtDfNlWZNGh3GlVBB0kszhpno8HW ceIYk8F0mc6Ek/++0tpjpYXnCOAbeDy9iuT2EEHuFonLbQW6CdQLNAA0CNSb+yJ3GAjTxoAm gVCeAnoAhGmPgB4DYfoToGWgtVxciTD7x/b/mJ7bUEi+AT1wnhTD+uMCrCKE5D+CnQ9Aj3yC /8IENHtKNaJ/OTsbQwRFNuBxwGGtcFYkyz8bA4gDJAJSAGmATEA2IA8gBsgAcoCC++0SoJLj KoAecAVQB2gA2ABugB/QDugC9AD6OX4bMMTJo4AJwD3AfU6e4dLnuDyIBcASYJX7DfNuAJ5z 8hZAxCGOawuvax2nw17o5/QJxUQYeF3CMboTsijgrwN1yg4G8sjiQ/TC9COAdE5nP5eeEsJT OLuH4lII6kIAuslOAnK4Plji7A22kEVydfsDdcmSODtmchzKRaLPxHF24LhMwunTFcLBP2RF gXKpjrdDuJyzE3BZCcfLubpGQ/glzm4qrj95zut+hetf4LLLXBtHQzjXtmAbqwAagCFEz7C2 7NKV57wdwnk215dXAfWc/Sd+A8fxgb4r4/r0fog9Pq/94XYIab/MvEe7wzmOr42QvrWHpIVz Po8H0Ap4AHi0R//+a/PPs/sX5eF2DrfdF+TBdr+Bh9uYt9ObOG/fXZz35Uth7eLtE8P5Wzjn /TaRu38T/6L2xLiOMTfMz9/Iw/uB9/NwHhID9uQ4d8zswcPHyJvGTDiv5NrD8/DY8nmx5k08 JBbtyd80RnnewNmH5+HjE+fJ5yGc95+wWBfko1z9G1y+Lm78Q9tlHbKgH8luyrb9iY/rOCf0 bueh9gP/kA3Itud90FM2GNLnXP/SOQb58M6+kY0BJgFTXL1J2zaUPebmoDD7yZ4E7CNb3tlW 1IMCnikkwNcCZRbeBUwDHgJmAfOARcAKYD1wHxxX4fGC7wccA6+5eTk85vM+HB47Bjib39up A/9c4TPAZog93hQD3xTTwn01zJcKX8nyixhZcGwWCuEe6iqKCfEPvm6+TN6f0E+eBhBci/Hr MW5NJnsBeBmwPZZdGC3bXqdhe2MDZRUmyHauffh1ErSrMJnzFbgvTJUFxvjMdt7CEwG9CrMA uZyOC7tRWMBBGgD1p/iAPtQ/znH+xK0HC0sBF2Xb60LUsyJgk0IlZ5utkHbzADsV6gJtxfYV mgDXuedv7LRVoQXgBLCANkAnoBvQB7gFuAMYCbSxSC8LrmtxjimCMVgEMbuIW5cWjoOcFkBw zYr1yLmxshTQt4j30R6uL3hb9oTYaYSzw1YgvQj8owj6okgc4ms9AfugnXaU1yPbve4OWW+j rYtwfDznyu8K8aHb2/4SXDf3c/00yuWPkW3vC/hxwK2ZiuRcWby/c75apArYoQjmiCJ+r6Hi /Ho1sOYrqgzUhV9Q0ZP4yL/vSHfvSAVtgpf4flgQQySEnLoJ6AUMAAYBw4AxQg4XAZ/k7hFT gAch94hHXB5AVjnwxxzg+VNPuDzLgDUufTgg07xPufQXgJcEOiWAYBn/DOQIAdEBPXJiA+Xz oGkJHJI5pHI4QSSnTp7KOZV/SnKqKEWeIqZX+amibYK0El5COlV+6jJNraJXzSkD0NVTV+lv 9Vwe8ykz5XZ69dCcRVBOK1DHqZtAvacGTg2eGgZLMeQdeoolCTm/MoKeUBk4m/J36BmU8fT0 ySR67uT79KvjFPrVcSo9a/JDespkDj1f8mv0fMlcerJkHj1Z8uv0TMnTv8Wa8BQLw/YpFtmV hCS/+M3IVgH0e6Rf+Zw08L3sOkDD7t+ybbvT31i/G+AnX/lw5cP1f2V69uEmnjBJTykl9NTR wHmj++j35FH0e/K36XmjCfSk0SR6xuj79HTRFHqK6BF6fmgaPTM0nZ4TmkFPCD3xb1auIHIo cpZEQQ+W4mm+GZmEpHcCSJCLMrIp3sqQwf0rsj9DTEgGQxhIi/hKNIn8SizZB7IwI4/kHY/c TWlDuym9YjftlW8vOv5gN6Urd9PxR7spXbcHmXZShihDlH49jNrS244/3k3pN3ZSRkxGTLi+ GXEZcXulHY/aSRmJGYnplj3IuQftke+L2m8vGxw/uQeN7aY97Ve6B00ff5qee7QuPSs962h2 ei5NY3dTWkpG5rHFjOyMvIy8YyvHFmlq2246/jRDdHQoPTetByjx6NDxgeMD6Z17UPduOv5y N6Uxuyk8T0ZKRsqe9gurMyMtI20v/0vv20n02YI96Ivmu7WTqA32aG/6nTDCtId70B46p4l3 U/rsHjS/kzLEGeL0xZ10PP54fPpKGGG9uj1sOrKb9rI9vvemZz4TeoI3nt1dT0SR5shG8hY9 8xn/74v9kTmRNZBDHakmJyO1kVryQeSnkf+JZEX6In3ka/R071x6zvVHMINpBA1EBPFPSt4m wlSYHXbBTwQJ2YQBRAAiAfsA+1P74bd2Evvuq3dfHc47uvnuq9Q5lAOUqkrVb98F7lOHgN97 031q3bGcVHdqe2pPah3c3U9toNSV2p86CnwmteHYZOpC6hLIo8BXgS+kbtDr89QtvD8mgbvX gC2QI1NtSMcOHouiPP7dV0dKoJ6Yw5eOJdGabcfyU/3w2+3UCbg2wO9F7746Cr8Efgf5IcjL RzePPeJbczjvmGG7vZj/2NR2fqRjDwK5jz7Er3WCfWbgzlvH/28lcncq7cO36bcV2fRvF4l4 jvORbgrB0RkScXR8m3D9T0/9JiGSQFAiuLj9l5hDTiI4dItcSK9Lr4u/tE3pDekNh1TFi7yc bku3hf6ecjLlJE13p7tD02l+f4Co3A4E+fhyAjkC5SIdUh1ShZYZLDeU6rbpc3XcS78Q3Xid 9tKHL4PPR9M2Dm3w9fH5eN34vPjXJqYz+r/jueBML/NXYOafMP+DJDP/k1klR9/6y7f+kpyl 40h24DsHVKSQ/k8ACYBY7pzvo/j3QgZPXI6E52G8MAPMONnHTEBZifSZJMiRSI7QNSTtryOw vpdnE0HcAK0d/38AKAPPpCe5pGD7e5f3B8k779vftycnv28/3Id0yH/If/jh4dn3B94fPjx/ eP494SE5rR//pc1bzA+YH/x/3s4GvKrqyvv7fN7LzeWCIYkhBAgEKFKGImaQIkXESBEhRUTM YAYxIh8akEZMkUFEjFERU0CgSDGlKTJgEZEiUsogUoqWUowWKTKUIjKUQYYiTwSMkDtr/c4h hNq+te37zHOf8z/r/vfaa6+99uf5yI2U/7L9sjCv2K+I7XX2OuPYPxNfXKnR2yZCXZqIX3eZ WMrd4l0z6U1PWbvpTcPMFcZ03GmsjrqTzDEmLfUvH+2O/sW0IVlTsjdlDe1Ynr2j4/qO5fKZ 3XFlx7nyWdRxUfbB7F3Zm7I38V3SsorRKBd+qxybWhe3Lu64tOOmdtNF62D2wY7VHauzhmYV t85pnZNVnFUsWltVbrum7Rq1k73j0idredby7FOXf1Sv8QffLh5DRWNH60mq13F21pTW41uP z94nH7GLLLyUGFgS3zouzd6HX+KD5N365/zJOZFz4mLZgX3xa2jW0LZ9WldIFFa27dNR6qlS IOs5a0627qtT+L8Rhv/oEPxHBDtWGZtnnNhzsQXSdotji02T2JLY900s9kLsBROP/Sj2I9M0 tiL27yYReyn2kmn+pfuxZa22TtDqZdI7TSu5fs6Ua90OGXJkB3LunuDIbhPwF7kO7S8d2bOD o/F3PadmXzrC71abBWZI5sisZZk9c+/LWp27JHdL7n25k3Mrs7bklmXV5k7P2p61LmtZ1rJW Bblludtz78scKOnbc7cLv0KOZW2zWg3MnZW7rG2x2BiZtT2zf+5TmT0zB7YtbuVnDswcKHlX ZE9r5WcdaL1A7Qiz+uKRtSVztlja2/hAr9GBbxePnpK+utXw3C2iO1mYLa0KsrbIR+xmFYqH kl/sBnbEt9xZWVvUL/F0heRd8ef8ydrS5j21q/nC82rxv2fr9q1KcnfmVrZunyv1lHNlIGcv z63MLM06oH87Zz9rL5Q2/Z79PRnnz9vPSw94NvasSYnNj82XfvC92PekH1TFqqUfvBh70bTg P1ek8b8prvyb5jZ9/2GoHJOY3TrwV6Mjee+wTzjj8R+7zDRWMMsMaKTXw4yVb2kNejq7fV97 scxBlE9pbShN/3tWlN5t6N0uvdund0fo3U3o3TF6dwq9uymWtA6GOnjUoSP+zA39XkHZATcd ry2zqRH3duh3Y731eG3xV7jK/SPxXki8/3x9fWwYbFjYsLHhYCMquRcY/e9q3hdLx35KykKx n/iLUbBNuZlDHIIW6ETtpoZRmNzA2aYobL/GemPDKAwMub+nff5ai/8lv+eadY38/grcelPV qNcF3Piw/Rpzc8L2u8j94633ZeL/j7Tvn4uCZTaYXaz97AczlshxWI5jZkh6eUZWi/yMQ3qk d2iRr2f5HI3PaJEvaYeC9PSx8lmfcVSk9fIZi86hlkfBEy1PSNohjnL9XG7xor0gRS1dZicr 46ieg9JEOyh5fXq51iW2MCaxii2PLZc6r4qt4j+TfMk1SFp906V9UfoyOVZIfavT+6SmpvdJ X5m+Rkqp5tyHT3V6Qfpo4QrSNwm7Mm0ZWn3St0rKDj4XNfu0tFtG9ZCU6i9YvKhVgK2VaqNl IrQzmpSV4K7094R7Tz67RG+r9u/Y87Glf3cNO8jRRWrYST5d03uk97qiNL1vWol8Bqbnpw9q sVfl9KHpIwQHpRfJoVrySTslTFf9SI789PzMHpnK8cFag8UWg1ucvGiPj9pSSw12WpwU3R6h 7eL08enFlFqc3it9EjVcFFv5N6wZOlL3Sr7V4QjsLJxj9bB6mW3yffFlbGerm+hZ/M+tS2wb q4NZJN9LLmPTrCwzU76PuIyNWc2Zp/tdxhrLN/q/U7o0Ym1zxvRtNDN0blS3vz7CU+1q+0ei 8aK9Qua0VfYq2UGvtldLzrX2WonNRnujiUhs3jRRe7tEqIn9jl0jO7j37N+Ypvb79vummb3P 3mea2/vt/eYK+5B9SGx+ZH8ks01RSpHMNnfJHjxd9uB3S9/QPfw88Fnw+S/I8xrJ8xvJCxrJ C0NZ6m4Nt0bKHq9rWPer4AZbw4TLvIzLt+QKwnIv4/pY/eXbqcu4PKu3fDtwGdfV6sGK2pjr YHVhRW3MZVt69bPsMk5b15K5uzEXt1JZrxpzrhWTb2Mac+a8ZTdaLQKu1tQ1Wi0C7oQ53Wi1 CLgj5nijPnEV/Vzb3zB3W8zdNnO3I3P3Mln3qmUGj/xpS8SqvtAS8xvxzyEvaiTPb9Ra8xrJ z35BXthIZ2GjvAsb2VzYqKxA/sFlPSCQtb7t+QuODLkKDWrc5ZK21C64dlXU9TdmPNNS/49W yF42dyW2GNNsnxmSOJg4kjgen5I4lTiTOC8o5/gU+X6wmS1p55tFBUWWT0I0jzRLi68V5jif UDNxML42+Kj8BYsNWmpLLTWycyZxJD5FGNHX782y5MhplqPYaPfxZa+BElYBNSyVepvEeWOa Sg+PlgdHM6l1s6gcCWOaVAWypidkFk/d0OjYHR4q77kkN0u7dJB2zgxpuq7piqarmx5oui4x MGWqfFuXKEgMT+nZdG/T7U2XJUY23dl0mXz2Nl2RGC3H2ESJ6C6THPJJDEwMTwyXtL3CBZ91 fC6z2GBvGbbU0r6LdhIDm66QtBWpaYIHEqXY3t70cGJq08P/H/ZNX3ZNPGxlEHX9iyETkSM+ XI6RcowO5bFylITnUmOcajnLvBCfIYe0THy2GRIfES+KFzc5ER8fnyR9Ybyem5yQ7yPi0+SY Ep8pqPK0eIVoFsXnxDrL92I+FzVHxDoHH3T/1OKkQEc+M0NLl+xMihdJ6jTV5/t8ORbLR/Dv vLL5u/psSpkcC4xpLn2zeSL8XhkczdOCQ9NTtsuxU44aOfbKIf045XAoH5PjpBy10r97Sd9f HZz1exPZrcTqY6dj51I6x+pTFkS3y7f6lCUpy6KzUtqnNI+dSFmRkhE7Ief2sdMpq+VYl7JR dE/EzulH+sYy+bSXT+fgo/n/1OJFe2IlI7AU73DRTsqC2OnoLNUXjc4pW+Cap3RL2Z7S7f+w z0ZNcO14cQeh9wCj9ZMvnLtwrj6ueGFzfd+/YTUJ/mu3tqPOw28ne12cl61sr0zwG34nwR6e /qq+SeoKcBSdOr9CZudOnlx3W9vctYrKi3xY13vkuQHW7xGsrZ9MruWaWl+ttSB1VH0llkX2 z/taGxPRd/yNPxzU/zN3oD64ZpSVw6nwiyRXnqc7sncjcXy7Xf302gi2iaxQtDdj5wQMGB2q 6J9W9CYp1rcDb1NMyvpiz47MEszXv/Szo/67xrrwuSf7AOd+R7019hMib3XK1X/nrMjvuCkw IvulyjsHnTtE3oXOIHReQOcD5P9xZAV24s6rguVgX+Xtc6SWaynOCzBPwFQ6B43lvYJ8UNGd QurNyEudY1LKdSpb12kp1iDKesd5CNRcr6J/0rtL5GpnK6UobvVeEX6zovOclmstd/5H5CJs tvZeklokqNGr+Pmqpto/Un+cPLVgR9F/Tu17D1LW2NCC+pblpenTbnCf+4DgYPXBTQEPu58L /lJluwTcAT/Ye1DrorI3FWYtuFv1nVepxWJwA/wPFf29yPeC/xl5SyxUu3fQ7s2l1TZp60sv 2kp/6IAs/ac+29O+b9zziirbxdFWguNo/dng5gAjrwvWIBcrOkXI3ZHvRy4BU73O2n/A3gFq L5IxonIULFG0piP/K7hD81pvqWz+EFlJrwb9ftrbIwvAKFgjOE8x+iN/vdT9ff8NqXVNZJpY OOIWy7hNOEsldYQr/dk7qammLlIiqdf7z9HPtwhe5euO97T/lOAOvyPyOMaU+pbn3yoYDXZp nly3JH/vPi5yf0/Go9XCLwWvE6YdfDvvZsEUV0dxVy03+alGNXlc9YU5qqn+x/DPK6LfX0s0 1yoKs42y9tE6pWBH8BGpY1HyTqljjs481v36t7jO28mfaC2SGrc59dngV3SM6Fh2auvlWiC6 WFP9cUn9/8M9k99WHb26aeKrZuTK+tnCf1L/W+w8KTiaerWh3AtarkTmOhidba4nMtcTmeuJ TEwjI/2nknjqfJVBBFKISQqt2c7V39TLCOKDfob2UtGs0chE2lNrjVKGliJ4K3HbpjEnGhlE o6uv9zbbBZGJaKuZYDYjJi2Sv2Qee115jYDgP0scjnlzxM4n3jxG1hxG6EFmpA6MLNlduzM0 VRjpD85DijJy5zAzqP6N6HdBPggO0ZnTba6yOxrNmYoyYwh6ndHJAYcpythUzatg7sDa18Hn vF8z+x1kRPxWGVfXl6TOLdZw5qi4+mM+VE3vRWenzl3K2ONU0z5J6ilvjKROUEb8V5xGXQai My65W3QW6ZMluyb5iY5rnllOV7Q3a6pdhlyCXILOAjAVzAc71WsfqEcupPU/Jlc+2B3shOU1 yAtYp7pwv3OCoqP/PV38R4crXPtk/QZJfS+p/6f2qDIeV69OXqCp66Nc9ffQ9ZRc9YpuW3Qe woeR5klsir49wH6cFUrmCus961fqmyUtZedYulM4Z8u8ag5asn5Zn2uqqdX/Umutt/T5XGdb LXzXaN9+w/qj9hlbe1EL0Ni68na1bxCdW63tgh9IFC27g/WarulWC5HTrbd0rrO/KoxjHRA5 1zqmjKXr5n9ZuvrfZukTzlOsgHdaMqLtG6y7sKN5h+BJrvWBxtOq1fpKpC1HlmCR69Rn648S CbGvzyjtJ+zfC76vV7r2b/H/Tvsdwe/YWvc79Lcs7d/bb4p+mf1zke+y32DVFh0noVeU9g9t aRf7gP1vgiOdJ5BlnrRHOd/XFpTYS31t8dleLvsxy37a+brknWFLXey7icAt1mDB6+xHdd6W meni/YxF4BZwB7gEfJd2bIG8lj5wNfIF8DT4B5B7G/YRcCa5apFXksrdEGt40IeRK5CZsW2u rqW/KQ5EP7izEdznqkOfO1bWKPAQfA/yfggT5R79z8ALIbI2qSyzaB+8VXkQGNzZofdaG5G5 9+GMBfeARfTeweAUdN5Df69icp9i/TSY+8HRYB44iNQf4yHPupOfYiEFa92wvxPNUnR6w2cx priD4/CfsD3utLhEPrzrwv0YmT0Vj8MEd3wu3h+SWifXah3d5lhGxynATi905iM/Bb8OHdrC ovXdE5Qb7FppTY+7Rw73J5PYtOaiuR1+q6JP63jct3KJjHNMd9eyM6NeyOfRGYo8VucKp5LU Tcq4vWC2ujpaC3W3YNcEGMw8gSbYXPfq7n1SjiBxDkpZSrl9kX1whpGZ1j2j6NGLPHqpTz90 aS9JVeQuqdshbHHVNzIvKjNGd5XUnbKSQSnD8Go/8mTkKp0BZPZQ3K+YxGaSmCfxJ0kvSs4I fVN/6vQawR2s6OwEz+vs6o5QlJVGLdN29o6glKCV6+UKwowJUUZ3PSMxeThMnUxP0HtQxmKX Ii2mo0mvILrKyFPfxqhXpPZAPox8AE2jc7gZAPO2xkGYMeDbaOr96qGUtUh1kvehuUh5ub5W +Sg4htQOoQ97tWeqfSlXcam13IT3Jp3FQax0zUrOSJ7Avt5Nr1NvTRu1IOuarncTtXY2fbje NzrT1srYCu+ZJmlTn/7s0Z8deGdDME5192iV6U7JGh1tor7pSHG47+0wcvW//NFqMo7qFzNv dA5qQYnMDEnGo0RfZeaH+sog8u4vNIa6s5IdKbtB9q4t2De+G+zK2Hcd0F2T7K/0bv6ByKvK R/QqJhpdzF76PdpxAvu0fuxVuMrwJW5WB1/v/5zyf4BNLSsa7vf66nWl34fryuvZZX3Kbk32 csk97PSuZV93gX1jFE+M7v1k53Yzmtew01uO3Fpzkfe47pBNSuRKdnrKfBr4zx7P6G5HLGsr D1HLyeNB3cl1QH2zx8usJvOG/r95y4vmCeaCmVxZN4/a8DZyHlcfBhwDnlJN8mbKKJdVQBlT p6kiKz9Kr+uFOQUzBssV5ArywnBNkalXJdY2mG3obENnW2jnOPxx5OXIiq+jOUpLt2fj20n0 H/W01WqxNhesxdpcsJZcc8GNMBu5/5BPvfKxkx8wWO6EZg88nMs9iq8gjwqxN1gD6rpfqBZM XRAxmd3VAj6rbHXFw23krUWuha+V0aA7Xs17FL5NsBtPvkCf2aMtG/ScpO5Yxkt/t6xVSb07 cZq7H224l3L6wn6VFc0YmEWkmnrth8NBE+gHso5ckScj56CjaLCzMbzroppzYboGPMxG5KOh Nb32n4V8LakfgO3Ao6ppF5J6SOdGO8qdnG1YOKQ6wqAZeqWp59GvDfKCrZgNWB8N87D1KDge /nUQxrx84aTwH5H6DDyyHayVfwzXZZ1ngt3CLub/FfA3gaxHhjXFBHstdub6JFv3lrre1Q+T lcq6UAOu9BmhKsvoiyHvBmV3l5wPPylI1bVVdHQvZPxRyGnwugv9mlq2v6aMyKKZfIpcaW5/ kU8o2s9wvf8detdUrihvk52F9ttd4skRxfppyDu0H0opu0A8jMaRWVP8WkX67deUEQyuDY+A 58D96kNoIYG3deqD9mH7OzoT2lMDhHmYvn2br62cneT9kyR3S5IjQOqe5NozyXV6UnYXli17 Lt2jquXs+i7MtF2UV7RnguN1BpPxJeudu0vnZPd1cLeiNxH5EbArzB3gOEX7vKJzO6nrkT9X 9Lugswp+AngWfAhcTer1yDsUI9civwguBR8GrwFLsPwqck/KnYNcpmjtgbkBHfzxN5JaCH8Y fj7yy5R7CuYMWEnpBfCLyHUPTAx5FFgBUwPeBNMBaz1YvwwMeb1H4T/C8lzwDfgP0MlBng3+ FGYZ+kTbZjX0HfiZ6NyPTAz9dsg34kNnmGPIt6D5BNgafBPN/eCDMFUgEXN+Bz8ZZivMcpBS vAxSg3YhJu4hUtsiTwJnUfrN6NNb7J3wlO5WwyeQp5AXxh0DEjH3MfirwWHUojk265Gpl0e9 3CLkD0mlrT0fvpS8tKzfXbHJJyCpEeoeeY3UeWjSIlFaJ3Inso2daSCyg7fuSnAADD3cT0d+ gLxxUm+DeRy5P3wuMj3BIxr2IJhnYFagvxaG1kneqSMuOVpHnKyw1yrKtYhcw+q9OPtp3Sm5 uyKpOhLB3YreRORHwK4wd4DjFO3zis7tpK5H/lzR74LOKvgJ4FnwIXA1qdcj71CMXIv8IrgU fBi8BizB8qvIPSl3DnKZorUH5gZ08MffSGoh/GH4+cgvU+4pmDNgJZq7dF6VGSaP2SOPWSJP R2hQd1b/8/CLAg9Vdu/B8xjMKLACpga8CaYD5fYI6k6uh4M5PIgwzKIgzth/NIghJX6EPDeI HpqrFZ030P8APgd5dtAi6JRh56ekLqN0WtOOEhkHfib69yPTRn475BvxvDPMMeRb0HwCbA2+ ieZ+8EGYKpAWcX4HPxlmK8xykFK8DFKDdg9ie4jUtsiTwFmUfjP69EZ7Jzylu9XwCeQp5IVx x4BBnB+DvxocRi2aY7MemXp51MstQv6QVPqS58OXkpee43cP+iexvQbsCRYqysyZx+yXx/qV x2qVx0qRxxqRxwqVxxqRxwqVx9qUx+qQx0qUxxqUx2ycx6yiiCcR4hx5DU/m4RW9Iko/idwJ FmDhxiAvqTa1mAYiO8TKXQkOgGH8+unID2AnTuptMI8j94fPRabHerSFPQjmGZgV6K+FoW9Y 301ONHrXNF1Hlq717uvgbkVvIvIjYFeYO8Bx7ArOKzq3k7oe+XNFvws6q+AngGfBh8DVpF6P vEMxci3yi+BS8GHwGrAEy68i96TcOchl7FL2wNyADv74G0kthD8MPx/5Zco9BXMGrKT0AvhF 5LoHJoY8CqyAqQFvgumAtR7I5PIehfkIm3PBN+A/QCcHeTb4U5hl6BNn2Xurzw48ey3vfmSi 57dDvpHSO8McQ74FzSfA1uCbaO4HH4SpAomV8zv4yTBbYZaDlOJlkBq0CNFwD5HaFnkSOIvS b0affmLvhKd0txo+gTyFvDDuGDCI1WPwV4PDqEVzbNYjUy+PerlFyB+SSit7PnwpeWlTv7ti k09AUiPUPfIaqfPQpEWitE7kTmT2tO40ENnBW3clOACGvu2nIz9A3jipt8E8jtwfPheZ3bJH NOxBMM/ArEB/LQytY6/jCSO/QmsX8sRwOvICnkJmIB8Bq2AWIxeA+f4zuj/39D55KnJ3rj7m cmXxMdZuCp5sejdwNT2JewV6j2s5moe46jnlf0vkeq5iznm5yLfoVRjMuEg+uFL91GsQe3Pk V9x7LFP/FZ2P1IJd49+kmsHz1uDpKrnGRTOMPodVnB2ZqXZUtqYHqIz1GKk1YFWg6d+jNUVO 9TeCw7W+rj6v6Q7TnXcJjqos9Q1QdXqT2knRKfdaao3g8xVFFt4d4ffUu6nUsSCiz0Q+Ri7T 6ymrha9z4M1aF2svT3vzqVcN2EkZ6zHulhwittkwtWjORqe7yuZj5PxAJnUzTCGWl8OUIM/F wiGYlehUgQWk7gp80Kha2/DtV7RaLe07zF9IzG8jStoWV6K/jmvJMrC7XtvaxdwxnhkyaudI UC+YVHRq/CVaR64f14X+j6elasBO9NJM9Ur7g5VJWQuUEc1R9LShyJnU+hkiNlHvw+BbFT5U UeJKnn0vppRzRKAeXEW94njYHQv52l7S2/XpWE44XpSPhnIm+tNpO837EHI/5L7Bux/eAVoK ffp/LbiQdu/E1fTH/r9oy4bj6BmsPaMRVkbGkeJY9I+EudQHB9lBvyt5l8CXwGwDR8GUhaOs MzVVfg3ycuRSdI4EEfN+Tn/Agup4A1T20vCnXFMlDiK7WSq7M+D7knczuWqRe4Oz8XwxMT9H VFOJ83R6V733T/SuEuYZPEfORi7A50J6+y74zQHS4guQF9CCC7h/Usdvah8NZjDlnSIty8lQ TZEnMron0moTqftExqDaPw5ziNmjdzC+6DmnkOvRjKLjBnUBnaD3orMKuVPw5gZ9YKP6H9mh nkQK/D/KTN5e/fHpG95LaJ5UjNCX/FJFdzveLtaynDi1O4Ll3kQsoRYivD0S4Z0QPzOcLWuY 31ox7mpgNNd+rFXQRhXMw+P8PzDW/kCc+xENla/ynxb7q7HWk3cz3tT71XY7T3eJ9apjzVBZ 5ivdc/YGn1S09ulaYL2FfBP9qiMR2OevZBy1F/wvX5/M9sJ+qjIy/z8q8m+8W7Gg1kZ7ene6 jd71krlFR9ZpbVl3rd59dafoSHT7I/uKnkHezX3aleAOmBWKzk4dd94cmO3gfN6BWQ3uBM8r L/HX1KXgYPIW4cNWfChHXq135Jy8QEfv6Tl7uCe8hvkhlVm9GmY5vp0i1wa9i+ts1Xt3kmu7 jhTyxjXV2qhj371Peb+rojsanZ3Ih/EtG2tT8aoc3EBNT4Y1qqDcBP6AerdQZoAEkVcs4b2p waQeCxDfzlO6H2Cgw5tay3mKN1jnUhnjir3Q36MYOalx82v1CYK1kZis1ji7vfBkGtb24eFm mK34OSP0PEHkE7RmBXFT/r/hB+JtAfpZKnsx5P7oZ4URCGpBG6kss42mPhVYVg+9NHwegU5f MIeyCtDfRnsVBrn0SaV/SFP9rjCjKXGtyjIelTmsMZE5UO2fJkqH4ZeCg8O4TdV2JBfPO7wB 3iLBPvTY+eQ96M7Avurw3MEbE7QvPWENHs4GaXHp/6pJ7bw2YW9XZnqQV3P5S5Bf4i5xofog s7TqnwLXB6mUvoEWrA68pdXKedpbTVvPQP9A0F7uFHpgkLpWo4G8hzvSZTD3kStL0UtD7gb6 PEuqVXRy0C8knqPxdq4yfr/g6TN9PoEnp9HcjDyM1MnIOfTkfJhhPH3ez0raif52GJ0NjJdq bSMp/YC2ODUtD3xDM8vrodbgj4WlDKa+CZ1F1UIkW9HrrKNVYqhxO0CN5gdvHjIeB2NtPrPK yGDMYnMxcTtIf+gQ9JMQ1U4PItCNli0JNZmdwMmknkGuJFc88FAtN4FvQv+PZuAt48VPMNsU KUaYB/y9yDyl8pcwCjpTYqHyTTZhp5dajtqKkXXUK4s5MI5mGaOvilrMUF58DvrtYfaraYyy ClbGCmYDfZ57h86Q/h06v0mPfVx0iv1PVNPrwzgS2ZnutxH8oc57bon7iF65eO/quHbflrzE xD6vsuxJdK2JquwlFJ1KRTs1GCNE+yby9vSGiM4gX9/lc11Zm5x5nq4mN/gP63Uu7fUOXg3G 5u1ugfYc3jc2vKNsks8it9E1kXexapK6Dq5DLgvezgI3K1rTwV2KTgbyRvQLwSqwmNTF5CoI 3/tSPh/MBrsrmrrwTbCBup6qbKaq7BTB9w5Sg7zKW4dUtkbBnKP0evi9gef6dN75KKzFbt1J Bu+ngdmaao7iWzkWOvHcsL5+LPbH6mypvLOVUlqE/rNP0Cf+diFvrB1StMfp+9V2KlgGdle0 RpH6K3yrpS7DgriRdxe1norOAjAfrz5G3gz2BqvAToHNZDftn3ieE0ZMfY4SsTpq/RCpq4O4 kWtv2CLKlOjzJnsmPmwD54a81rcvclRtWsupe20YH/V8ePCeHricsoahs40Sx5L3CMzV6F/N m+dH0T9Oanf4JdSoBCxDfxd+7lLfrDXol6K5POgzobeVuo4o46UpI/IIWpBoKONmqTV3Br71 Df2n3cMIVxL/SuJcST+pJMKKBeA4yqpFvxCmhFz1QY+FmQ0Wo1MQ1ALsDq4jdTO4gLLqFJ0M sAhry0ldF0ZG/dwIvyaIA3aKg3LJtRj9c4GO6kd2aL0ijCm/PdhPee8l8p5UjESV8UthkN3t xCpOiXspPYEmb29GGGV+ZjjG/0BPCCJzGq9O64pDvz1Fb6kIUPu2zBgVjI7pjGuu7JLMjTwB 3wuuwXJPxumbyO1Udnnz05oRjnQt90kwldmgLpgTgtmAsnoHM0Aw3mG6h1hN2ynuI/Ut+DJ9 Q8nqiP3/Ihq9wh44kHFarbtuYrIPndHUsU1S96h38ly7JHzCHtM9WPgGThqtXK7vjdDKb/NO 1DTekurP0/P2MIvNSB0d+p6qvZ83gjrBV8Pz3o5dZdjh48l+/B+llqXPV+v7QipL66u8hRLf U3Qmo7+Wnu/z1P588I4QqUWUOBt5A28OVAS5tFz7CG9YzaWU6fhzUHm/GfU6oquA1IhexHtK 1NfZg4U4PvC2m/QE2Tk4NrlOojNWo+Tw60WOwxsU45Az0O9DBKoUPd5RdMoZyy8Qt/ngaGzO CEYH79rlkOscfran1m+BNcGbeFoXGWvVzGzV5FI7I/C2L1gN2oqyf5L9sDWeuu/iDbRlWM4h 7zfCOE+mpsq8RumF1KUCuTct8ialD0QeQY/6AanXgUfw5zvgD0i9jhrtRb87uJLUHuAK8FT4 tp7G85yiVa/xtF8hVgfRKYNZRR/rB9M97HtFlKt+/hgfaohzWtjfdC/Hu6MysoIaVTMXqVxM WRthSsk1APvhe6F4GwVfCSzj4TqQd6dlVp9MhCfTMyfrzp8S55CrQC27vPXnMlLcKZQyUrEJ b6ZFeYs1wvskXmdmnpmKPm99e6eY/3vAuJSbrZZ93l+VMVhET96j+zQisIYSRxOfAt6u6cEo GMU7kx8wav6dlWID1vbbTYiY2uxJrV8ET4e9dDJzUdAr1PNgvC+GP0pMTlLTfPhyLcsZS7k1 9LddyDN1lEnfU52dMPsZs7z7mhyqbwkm9b+oB2/ixEyV9ZLx7i69u9jk3PNwaYkZPv7e4lIz quTuKZNMyZTxd08wT2lvuH1Yfo6MWZNM6v9MN01MirnCtDBN9ZtwUWPxu5jNTKrUNSHf9S15 TTENks1/HRRbw741JEd/9Uo43ushzTXNGzQt45n0e+6ZONnMBCvAOeACsApcOaZkwjizbuyE SXebjeCWCZMmTDHbwZ0THnygxNSAe0XxbnMAPFzywD0l5hh4cuK9YyaYWrCuVJItA/KOKjUN 0JYaNZEzbyHp3zBfJrnib5DjCjDeCBONMKURNmuEsUtvOElEL2HzEDNMN9PT9DUDTIEZYUaZ sTIflZkZpsJUmkWmyqwwa8wGs8XsMLvNXuPrC6ZmLdHUd7A5+8tobyvaz/j6twPREfhuRUsD z6MzRM+S85rg3ERbS/+OcLvhrwtTughK/03JD8+Fwbl5VXBO6xrku3KTnOV7ZmrwvWUv8UHs t9R1Us9FgR8tx4bpU8N6p8rRnrRUfvdjsBliTPQn0Z/w7f/sN3q9+6Qtm1vt7TxngFtosk1v 098MMsNkVBWb+0ypmWZmyYiYaxabZWalRPlS3A+aI+aEqTXnLdeKS5M6Tc40ORuzOJ+L2Zw/ izmc62KunM82ORPzOJ+N+ZzPxSKcP4tFOdfFmhhbUmPy7Zxop3A+G4tzPhdryvmzWIJzXayZ aJ+LNZdvn4n2FZzPxlI5n4u14PxZLI1zXSxdtD+LZci3OtG+kvPZWCbnc7GWnD+LZXGui7US 7bo/iYj+H6epZuaXikg2NT8Tax1Gpk0YmbZhZHLCyLSTcs7E2ofxyQ3j0iGMS8cwLp3CiHwl jEjnMCJXhRHpEkbkq0SkaxiRfwoj0i2MyNfCiHQPI3I1EekRRuSaMCJ5YUT+OYxIzzAi1/6V iHxxbF4ekV5hRL4eRqR3GJHrwoj0CSPyDSLSN4zI9WGP6RdG5oYwMv3DyNxIj8kP43NTGJ8B YVy+GcZlYBiRm8OIDAojcksYkcFhRIYQkYIwIt8KIzI0jMitYUSGhRG57W+IyHazy+wxB/gd jdOmzrKtWGx4GJHbw4iMCCNyRxiRwjAi/0JERoYRuTOMSFEYkX8NIzIqjMhdRGR0GJG7w4gU hz3mnjAyY8LI3EuPGRvGZ1wYn/FhfCaEcXlAaxq7L4zL/WFcSsK4TAzjMimIy98ckRMNEZkc RuTbYURKw4g8GEZkShiRh4hIWRiR74QRmRpG5OEwItPCiPwbEZkeRuSRMCIzwog8GkZkZhiR x4jIrDAij4cRKQ8j8kTYYyrCyDxJj3kqjMzTYWRmh5F5JoiM/gap+s0aNV/WgLiZpC9Lyuyf bTqZ7hKvfFntCuOyLkWWRl6yB8cfDaUh8ZlIPxbusVAaEp8lUhV6j4fSkHg5kuo9EUpD+FWs DrKe9pL2GCyr6WiZ1afIWvpUvKKhpCcbSnqqoaSnG0qa3VDSMw0lzWko6dmLJcUXibQsslS4 74XSkPhipCrhng+l/5dHlQ0efbfBo7kNHs1r8Gh+g0fPNXi0oMGjhQ0eLWnw6PsNHi1t8OiF Bo9krbK6Wd2kad7Wvz+03rXeZRVOGNf9qttV/3sD3z/Tv0ez2lo5mqNhFc9iFW+huyO3n3tj 41+bNfrkNSr8dPdeXf3dsfxeXLa59CuoaejrL9uav/KrtwNkB5EwmbJr6CrfXOebxrbPIt3c IA1CcqTMhElD4zSptaR8yi+ondYduF0r3yz7LNqWtdS0/GJ7mGqzWsbpVrPfHNGtkZVmtbE6 Wz2sPtYAa6ildzrdlDFi93mkexuksRcl+9ciLUba3SC90yDVNEjvIoV+2+/pN/sj/X1Z+01j x3+Gzm8atPc0SO9flm8v+bYJPmv/XHAhOr9tpJNhb8fqLyQOi+W8r8HSBw3S/gbpPxukAw3S 7xqkgw3S7xukQ0gR2cNmmhwZ17qP7WP/Ukp7Qcr7JaW+YL/Fb9fulG9V8n0nbJX9trBV9ocN tg4j2SZiV9pzpcWW2StEc6W92sTsNfYa08xea79qmts/sdebVHuDvUn6kkMvSpP5RH/nS/tX evj7uj+UhB/bPxab60Xfsf9Df9lWe7W9gF8B0d9P1T4u+zHjcaUkOxF7ib3EtLaX2ktNG7Hx hmnLb3tcz2979OM3UJ3Ip5FaW69oHIfinZij9yviThx7ouH8t3PBeU6/uXvdvdK7P3D362ix RpqXnGudHCfDyXbaOJ2drk43p4fT05nllDsVzlPObKfSmesscBY5S5wqp9pZ4bzkrHbWOGud dc4GZ5Ozxdnm7HB2Orud95y9zn7noHPYOeocd044J51Tzmkn6f7afdf9jfu+e8A96HRwP3M/ dy+4Sc/yHM/zIl6K18xr4V3ptfLaerneV7yvel/zrvGu9b7uXed9w7veu8G70bvJ+6Z3s3eL N8T7lnerd5t3h3end5d3jzfOm+BN9L7tPeQ97D3iPeo95pV7T3vPevO8hd7z3gveD70XvVXe y96r3mveT73/8N7wfu79wvul9yvvf9s5D6goknWP10x1DaFIAipKTkqUHnIQFRAWWTKIiqhk QckgCGIASQbEgIqIgmAAwbCCgiKKARMIgmImmMGEIgZE8PWUYd293rfvnPfe3XPPuTOH7qqu 7m+qu+r/q++r5tRl1ISa0VXUim6gW+gO6kD30AP0EQ1x2Bx+gXLsjj3wdLwD78IleB/+DR/G R3ENPoXr8Hl8EdfjJnwV38B3cAd+gJ/gZ7gHv8Hv8QD+zDxyPiEBId4q58WQH/IzbSEP5Zm2 UIbKgA1VIeM7Qk2oCThQG2oDPsiFXMAPDaABEIBJMAkIwuVwOcAwFaYCIZgO04EwXAFXABGY CTOBKMyCWUAMbmDachjcCDcCcbgFbgEScBvcxtBmB9wBhsNdcBcYAUtgCRgJS2EpkIL74D4w Ch6AB8BosjqHNDwMDwMZeBQeBbKwBtYAOXgKngLysA7WAQV4EV4EivAyvAyUYDNsBsqwFbYC FXgL3gKqsA22gTHwHrwHxsJH8BFQY3pXN1CHz+AzoAFfwBdAE/bAHqAFX8PXQJvpeYNgHNVA NQAd6gp1BdBUC9UCuNQ16hrQpe5Qd4Ae1Ua1AX2qj+oDBtQH6gMwpD5SH4ER9Yn6BIypIWoI mCCeKEwRG7GBGaIQBcYjDuIAcySIBMEEJIJEwEQkjsTBJDQCjQAWaDQaDSyRHJIDVkgJKYHJ aAwaA6yRBtIANmgcGgd+QbpIF9giQ2QIpiBjZAzskCkyBb+i8Wg8sEcT0ATggCahScARWSJL 4IQmo8nAGdkgG+CCbJEtcEV2yA64IXtkD9yRI3IEU5EzcgYeyBW5gmnIA3mA6cgTeYIZaDaa DTyRL/IFM1EgCgReKAgFgVkoBIWA2SgCRYA5KAbFAG+0EC0EPigRJQJftAQtAX5oGVoG/Jn+ nQICUAbKAIFoNVoN5qK1aC0IQtkoGwSjHJQD5qE8lAfmowJUAELQTrQThKJiVAzCUBkqA+Ho IDoIIlAFqgCRqApVgSh0HB0H0egEOgFi0Gl0GixAZ9FZEIsuoAsgDl1Cl8BC1IAaQDxqRI0g AV1BV8Ai1IJaQCK6hq6Bxeg6ug6WoJvoJliKbqPbYBlqR+0gCXWiTpCM7qP7YDnqR/0gBQ2i QZDKYXFYII3Dx+ED6QKHBA6BDOyG3cAKPBVPBSvxDDwDrOKtuwRW4514J8jExbgYrMFluAxk 4YP4IFiLK3AFWIercBVYj4/j42ADrsW1IBufxWfBRnwOnwOb8AV8AWzGl/AlkIMbcSPYgltw C8jF1/F1sBXfxrdBHm7H7WAbvo/vg+34MX4M8vFT/BQU4Jf4JdiBe3EvKMTv8DtQhD/ij2An HsJDYJcQW4gNdgtxhDhgjxC/ED8oFhJkgu8SsmZfNFSCkpAPjoIakIb6sA+uhuthDsyDBXAn LIYVsAoeh7XwLLwAG+AVeA3ehHdhJ3wIuxhmPmeu7KOaYBd1k7GwCgkgYTQMDUejkCxSRKpI HWkjLjJAU9EMNAv5oACmH81H4SgaxaFFjC1JtBylo1UoC21Am9FWlI+K0B5Uig6gclSJqqkm dAoqofPoLhKGiugTB3AolIU9cRHeg0vxAVyOK3E1PonP4Mu4GbfiW7gN38OPcDd+gV/jt7gf DwqxhJAQb8WvSEI2QMjGImRjE6YhwjQOYRofYRc/oZYA4ZUg4RUmvBIivBImvBIhXBIlXBIj XBpGuCROuCRBuCRJuDSccGkE4dJIwiUpwqVRhEujCZekCZdkCJdkCZfkCJHkCZEUCIsUCX+U yHioTMijQqiiSqgyhlBlLKGKGqGKOqGKBqGKJqGKFqGKNqHKOEIVHUIVmlCFSwigSwigRwig TwhgQAhgSAhgRAhgTAhgQghgSghgRggwnhDAnBBgAiHAREKASYQAFoQAloQAVoQAkwkBrAkB bAgBfiEEsCUEmEIIYEcI8CshgD0hgAMhgCMhgBMhgDMhgAvRsitRsRtRsTtR8VSiYg+i4mlE v9OJZmcQzXoSzc4kmvUimp1FNDubaHYO0aw30awP0awvUagfUag/UWgAUWggUehcotAgotBg otB5RKHziUJDiEJDiULDiELDiUIjiEIjiSqjvqpSEY6EwyAHqkMdqEcVw1VwHdwMt8J8WAT3 wHJYCavhSaav1cF62ASvwhvwDuyAD+ATXu9hrnxDNcIn1A3GwirEj4SQGJJEUkgGKSAVpIa0 EI30kTuajryQN/Jn2nYeCkNRKBYlMLZGomSUhlaiNWg92oRy0XZUiHajvWg/OoSOoGNUI6pl 1HiOUaUQsx9AnzkQrcHTcCHejffi/fgQPoKP4RP4NG7AV/A1fBPfxZ34Ie7Cz/Er3Ic/4E9C QIgSEvqPKv+jyn8TVbKAHZmBGQP0yVsaMRzOxM4dzEj49FuK6QG8SDaCyb1hopA2cp4IXMp4 0EzZlz18SqIenm8MiJfLYq7s4MXzLA5jXY6JpL9F0JfANdAOukAv+ETmfKSYUhWgwcRpTHwI mbiciXneM9sU2M9sM+AAs10jUMVETP18j5ntAF8Xsx3kY36R+vwTC++IhQ/Ewkdi4ROxcJRY eEIsdBMLz4gF5t74nvPOIKkX31Mvv6d6vqdefU+9/p7q/Z568y0ltP17Kp+kmCfGe5IAMLRh 4k6GOAcAxVCnHHAY8lQCfoYaiKyZKw6+rBJJsZmaMvEtC7DYBV9iR9Aq+JvgwZ+8IRFk7iOX WvXDrIsYQFQctZCKpxKoRT/MqvBaGzGlvHkTQxK1Mq3DrieRb8P3WYKHvBVwSerR99TjbymB St7Z/20k/eUNI+vL2x4ApFPI3A75SCfSydILOQIaabZp74VZfOyCZOlg5lAAm8XiYlqAgzRF IHs0ArQPR1CTw6JYyUZsFlXgRrvQWj8ckSmUWyYDxpOvE/AF0SAchIAAEMP8TeB9acUfjFGS WRY5oiU7115yYO9Rqpu4Ze3n7o07C5JH/EInU+J0MvtjAWSz2GxRcAqsGj8+Y1jzhHd+zzsm 0cLfa8qimDpFcDVpdQ6cSmEJJavwiPio4LlBMQpqfuoKXBMTIwWHYL+o8OjwwBgFq/CoiHFc OVrmy8nD/1gSHuUTExwexlWk5XnlUELq93LX8PAYBYsFMUHhUcEx8bTcSGETI5rLpWkjmvl4 jhTWpbm6etyv2b+hRskspR8fCwsBmMwSBcxxQXYyiwVK2DWnIh6b9TpKq+VvXjibflpYkqk6 58PQRvuiyqFthQoTEl0KtxZmeevOb7b0j39ZFnvR/Xbvs7w0maz8lMDyuvkJvsrXZce3i7LW d206e1I7MDc3aMyWK6ZaJ4UOTx9zyuaJ4ATjTVolaibFz6cst3yQIlqdGzLVpyw5cYe3dpx9 95YKf7NcZxkuv4pkfsmTdZpSj81z/CS9p6OAfFkj1/T3e3qy2eekr56cal2+YtlJ0+fu2Y77 B/ckhMY4HpBq2CSgpgimrfUONqr+VZxvvMfnmQM7AwX5d7ckeUzrOWI2e0RSHHX73Yn9yzYO Hby89Pqe0VFe4y8df8VfpESXc1IvlivESaR2sHnryBclFdNJu+ikQuZpyrKopFw6afMysZlX InqCo7YruyyRPOSw5nP9jqh/ffsl/0Ufh7w23NiFazPfbJYyeFHFUrkZN+yNl7du/nZcPwGt y8i6aPpYsffVtA1ahwt+ueDb8+lGg5mZZ4mhe/CQSujEiw1721FiGzfTPF8sYl71kLiTVHDt pytWD4Z5Kjg99V10YO+oC5pGqtonAnaIr1QV9St67y7Tr3jx+vA3rmVhVrp8g8kjPzyaGyLs 8q7mtev5midn6U8KXIEM2Y3qox1aZdm7Xi/rhBUz+35ruzDtZcCU867uRyqgmvjntddf8Wct qdpcV2qk9TDhYXHcg9gCcGXexFMthis7LcSLDeZJz7tjcO+aDPWw2Jq64KlnHOYgI+xbKVi4 +mqr+0SbyzJTd0fcETdN37Agf09LAUMFbzoZ2n+hguC40mF3nT97bauv/cYU2b8LBozujXWZ D0MAXQYGXF0ma/ANBvGEoIwRjgR7qhtXgh7Gy/BLCE7ziQ4KDpsbw/yMGC3CO8gnweca4B8a Hub/rWKC/6xiyrTil4qN/rHcP0DBLXhuGGNVwdnK4i+pUBm/+PqscmuTYv0y7u1+VYMpcbUD 8tvPW0f2NNt0XVt9Zr69q2/fFvYZh5tTQnRUJgScbFSuxLaVSxe0WdfszRJxrlPV7C14Iqws 32yh8tF3S9Mo610b7OS3XC7XUTpjp50Yfmu4nNlqEzGTthr1vkAzbZbu56GxtrsPh7DS8waO HfJbmtzvVZCUkrrmYG9VdlGT8W7n1JFj0x3b6HfAvO9cv3nSibQXISZ7xum/qxh3QHCx77qF gXk50cJpB3rPvlE46iSe6VevdUvXetTLartNZs5uUo2BLvF796Vf8JiQn+ycEYZ+Mzi1SKXG NdB8i2OD5hK9sJRfOM3br9ilscPSwM7a9A63r1T4SCe9pyV4UFClhGhBDj8zoCHEB+G/BypE eXWUYLE+U4iGzI6W5R0QoUZQkg2yjbEgYuaB17fPOua6TB5XNNnvFY15xaIUxcgo7QfpEMYs Kt2/xG5Mb+Nxx5jC6WNjNBaUpw2W2mcvBA7dl55J3Q2uEylMfMO2OncpveGDW8Pp/BqP8Fd+ k0smg5ebLuS2ylTh/FHC2Tduy+1TX9zzYnd0WVa7yRrznHnHjUNbMg4oD3Z0Xw8WWJdRM3QP VOu/eZ/YLyY+Dj1T37TBcr5aZKVxVief8MVZQZdrllnMDyyurqxeo3+pF4olJrxt6bTsWDR0 717Z0LuOVuHyiOvrHzgdMS5M1L5mfkcf+xqx85PmKa945+WXddCz2uSG9+qpKaP13prlFCQL Fc5ZVa5VuWNXfelthSMn6VGpCpLCGsdd+yw6Z9MP1qsFp5+KuP9mT2njMsuoWBGGMQkMY3y/ MsaHMzaJeEj8P+oIMZz5G1XNA44xQxpdXa6uvoEBDzg0434wWT1elk5a/v9SN2HScZiuSzk4 Obt+Ox3+k9P/kj01URUrnsjkp56PqfL2gobmeYNbEnLVbZQO7kl3e/HSxvT8TISnFVdeQg1X 7eN+iUgtf1TfMfdJ0WDM2A1z82+shJPpc+8vHrtoKsvvMdlpJL9wf8WooL0qMgNoWmp3nSOf otGeZ41aOkcsLyuiPdcfX1Wbdl46oVHdkO/y9qkN1a+VnhUr7xRWPz1w5YznBD/z81pT8KL4 1FcZPZE1Vp4PisqF30wdUO28r3D1Se7s7F162mpLp0lPnSekO7knMCT8lXFeD3tf7o62HD4x kfFSwffjHW0kO4+uvrIgNK8M5GlbvnWp8uxbaL28e1yiZvWsy6N81PZlWwnWzbP8fFh3/051 pfYRXVe/sucDnfT25+z5XcXKzdEa9jUDjxQ/RsptGd48sv/s7pWk+WRFeapnhMy3jHBDVpmS okcs+7nsJ/NOkKfMaTPapMCowCBNLygmJsJUR8cvKmRc6Lc2HOcXHqoTMT+Yd1QnIircf4Ff TLSOlRvT8cYxh2jbbzVk/JLxtClt/C1Ps9O0vhqMi4v7mcGAqB8sxfxJUIQ+VupNfjUhD6JD z2y5ESqUYXbONjpBtVHrvtGibfr5NcqNJzpuesUPmy/hosDyOxr1nv/BucUuGiPUrjU/2arR JCXcIhG5Tv25R03/9TphnQMB2qEO1uoeUSlOE1vmyVr4lsR7rXl1Pm5lPVtt3LbzeZqPjmoI tD3ffP9RQuZssQy3HW3eTnE5kd7FM03WXS0Vl0fdZ6xLrp52OXqg6u4nTgroiym687lBtkAZ 8T0ca3B689pRe5O9x3YNpGjKNVP1a5qShW8UO1hNWtDS3hbXs9Jrvmi6f1bFscpjpXPdFa33 2gU9cZ+9StJr7sLna72g2Dr+bSoKm7s6wLCIkv5DURGV+++fzh/BZuizjaFP6hf6iM3DW5xq gWrpsDvW8tMT5hb+mUF/j69jSJtwDWkura9vxEOPCZP9G3wd9+DQgOgYn9CI/6mvc9cobODA BUu7SKkLjbYT3Go/lkoe09KtFndyvbD8xQS9W1O469WOrPPvlHdOOXb61+al6EPPghOrzhe3 7g+OCFw4NrDrSGVP6tHLL/cOiu/EM5TUdZom3fKgpGMPh/qH2rnfaXvdfjJ/+fllHUvt2UbZ b2u383vIBf1y+VZtrJfO4iOqVIXHzHkyfp+XJY5/2UqpOpjExfDNOu11M81Ia8FFkadyJgKJ sUPbQsISOp9PyNq8PVJkjoaTlK+37vaW5Y6aSl5B1qvadVLEnA/1Hx6dGfJSdavEh3qxG6ki fcmx0YbnNiYUNnhznqODaXqVH7JnplikTE/NDjsor2XbEJ5n1Tmva+mYNfO/8CaZpcY8EZWf EYf/38PbEeMIfJ1vGM7iuTDgB1CGdzlO3HxUv/TXtKzjeU/LzCyszl2hR32/QJJNCckJAjew APgCK2DxR0/oH9yonwAq22EY93Sic/WwNTt8+FgiqyOsM3ui3WsmCiDtz1UubqkyL0zWVRZ5 4PbVR8ykmwfK9lys/M1FUTqcP3jJfFioZPMipCI0UanK5mrKm0zRE3wrDU89W9IdMcs6f31L Q2Pbmtp7JzUuJz6/uF+3Nf1ovd9Zw2YpxZOx7Wa55dLR2xUzblZUiLuv7ss7HWCXqzYmz3ul qNl5iYCFttVN+5abOh30nd5Od3ebyD5Y0XvbJKlfQnG1/zI/DrWpN5dtpbPIJuPYZ/atgH67 9tswZkM5ChNq2HZXzSfR9vXIvGGKxmyZ9DJO3SbdqkeTzrmZ15SsaO8KNMrsU9qU13Awzt3F 9HrU5EPK7xhA7WUAtf67e5StTdwjgb/PPfoHEBD3iDbSNWDQpMsljNL7kuXysnRS+b/CPRpL q37JyoVZBUcEBUQpTHazVrB2czQ1sjDW1TY0NrbQNrEx0eWq0spf7knmj/ek7ca7KQW3gKjY YL+Av8TbxiRBBUspl4RbG19sHbyb3jwgkiXxdK+RmnjskINzaexmjQ2/dJZ4BLMfZS9xSL2z NLJnAbhTbRUyEF4W+UqzOXF9Y/bIbTvqjvW/X9Lmc0+blssbox078bHNpjX7b64wutnQ86Zp 5plPQZ29/llbu86I9xedSPl0fVUjMq9hxTqPhR9SKkekZXqfmKWuNb5p12COp4Gs04ha45ty PhPNDcs9JIfHbTQT+wgObrg/y6h0bLWflq1k0tQHIU9LNDdmZogsKQK74lT4cjQiYJWGytrc 9rpCpV9P2s/gxLlHWR2c4N+2IYV/+pGh7vQpAobl5R/0SpbYF8Yv1Z2hLrL98NvO8dsnPrcx +9Gd+h0IahszTrLNnt3OPrbYRvRjfd+SbZ+b/+Ap/ZQY/xtPKSY6ws/n/8RT+mYp5uew/oP/ x6n9Ga3Ay7JP91syAi+pP/A8ehkkLxnpVacyQ7y6+P38G+lDmfWHY+Wlld69v3ep4qgFa7TR PlujTREfG/T2qK2uwkdiJNQqyxfc0xC4v8qpI2fi5kp98aSnYm2yd4/5Nzk6m9mvHBzVprq/ dVP601/PPnrVbzFyFuvZtIzFsQmPwofSFco25K3OPTlndMFwWqWzcInPOll19TNT1ppaLV/x sr11eZuTloHZEwsL1l4ghHuvT5FutMxcdPCNduYs9XsnMpeuGx5b4T0gOXZvuLifpdp005Vm qyY9rKxrWD9NxsZjflb9egcPBC59oCdZO3aMyqh5K/aqbXSHmlyFS29c55gH1QJJ4nflTK9Y c5OpIoZY+WwWi05K/xtDtj8Ekr9PgBckNdKS30cnNRaXDyLyH2q8MetrYwpArtCPc+5MbX7P Ya4I/WPpcIYl3y+kuIwA7GPOCLnsn1S82YuvRY0/ur5xZuUpevoPlwhx7WjbAt60vTvwAUEg HIQyewXgCgLAXGagDGFyUTvGLFP5pz02Jj4ifG6UT0RQvMKfCEUls0DOp7wXcWOKRKPNu5v4 BHZHHqpgCYeZT0yYW/xu/43I1mybvMjUcZU3dO5t9nI23DdSYNkF5cqXnS/CpA/tmz7of+9l kOgppf2Pqzc39E1sMRM3tJhx0NOfGxN3eq3x43eLPV3K2hdK6LQbys+R3AHi00Mmd0ZPD9s6 f+nbfJux8deejh998/WgyYLI8Pl+OQ6LnwjKLZnJ/SiVe8t35ZS3r/tNzK8Ortg3eNjQKCaw 4kB0h593DP361m0d81c+CdStxv4PrSsKB2L8j9jvd/Zqir1kWaNZ8fpjzeTiGbslP3RNFyvW XtU9xLqjd6S6U36rUlaa/7Or7+v7NpzRLg0QdYxUOtW7cNVl8/IdyWx5Opkt/Xu7cLjJbCHm EP+/vFv+eaj8wwDO97VbFsyipX7sffj310Is5je/lyCuKDPQ8oZYPVpX31CP8f7/3PlesbUf SIztHcp5tau1QMnHobY7TvNPnOJ1kcip4aI97vZpR5SeZoGoSyWSEY43S7qWFt4a6Ov92LZH w+AM5/YGO0XRWakzwu+UKg+f/sQbvBP2NCwL0lOPb5D30ddPn5tffnHuVdtpA0GTzrgmeUiN ihMUlwavfvukK9G/rnVDrfaitNEqb9NsbfnYazbcujLJwfK30EKZ1YomqTJzJm0Sod/JXRcc v23BwhXGviL7f3sYLDBL7KZ30yrfZPW7+1S6JSbu3BHd8WbO5LIpdSkrzBTjEhqvXQkfE+Ml uzF7zlv9tfEL93tucbOY9yF+Ysu1X1uX4xmx2yoPlGs2nc61E13DP+zqzav9s9pnj6jed97+ U8q5SSffCuuXl5RpiQRNq17uuem/AAvoEFoNCmVuZHN0cmVhbQ0KZW5kb2JqDQo4MSAwIG9i ag0KWyAyMjYgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAyNjcgMCAwIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDQyMyAwIDAgMCAw IDAgNTYzIDQ3MyAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDQ5NCAwIDAgNTM3IDUwMyAw IDAgNTM3IDAgMCAwIDI0NiAwIDUzNyA1MzggNTM3IDAgMCAzOTkgMzQ3XSANCmVuZG9iag0K ODIgMCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggNzk0OTYvTGVuZ3RoMSAx NzEyMjg+Pg0Kc3RyZWFtDQp4nOycCXxU1fX4z31vlsyWmUky2SaZmWSyL5M9EJZkCEnIQgiQ jCZAICEJBAUSs7BpFLVuEVzqjlXQWq1FZTKgBqFKFZdWUWupdS9aqlJJxb0FyfzPfWcmBESr /m3t79O5N+d97z13P3d5d5J8BhgAmPAhg9ll9VUzGvJ7tCBc2ABgvry8tKxhwcriuwBuKAOQ HygvnTndO2twG8C1bwCInTPKyivee+KTL0EYaMf432fMrqs/2MRuBLg1Adimt2bUu0qfPHCQ gVAoA5ixsK4+K/fLkF07ANgr2GpL24rW7oJXsw4CJLuxfFnbqj5bVlVBFUAVtqkIWtK9dMUd fyu9DyDtUwBV6NLW3m6IBDu2/xyWNyxdvnbJmgfLFgPUYZ6wtzo7WtvfVYxWYP0LML2wExW6 jYo9GL8e4wmdK/rWVHqVuwGEiQCJq87u6FmZOD32aYCL9mP6ncu72lpfe/wVDLdvALBUrGhd 020+Fh6D5Ycx3baydUXH1Xs33Apw8RqA4Pzurt4+72x4BPtzH0/v7unofvpInwMgPwiN+jPg tpXfPhy5/Zm+Rfopn0EUqtHt+uA83n94Mv7mnmOvHd+oOqx8EvOqQAByWE4Bo8D2qrcce+3o parDUk3jnHgL1+jjoQ7kkkIAA2RBC4C2DduVssiqhd2YGiS/RZ6HVVqI4ovwiABBIOiVgiiT iYLsbRC8TrjPi2VUvGBtvc0GNgxsoT4obxeSbMA2S5XukQfzkWLtwSd6w16A/xknLoaNp9Mr Rk+v//91sgtPrld8Bkr+He0EXMB9Hyd+AjP+nfXLaqDmpLgSqv+d7f23ORz/+T90neyLr6/z m9qT1ULld2lnfF3CKyfXK+ZA1bepQ3gKIr5LmwEXcAEXcAEXcP8NTrgV3v1e5eww8EP35f+K Ey+CtT92HwIu4AIu4AIu4AIu4AIu4AIu4AIu4AIu4AIu4AIu4AIu4P7DTvRJjO+/wh7BGIaE u0EGt0t6A2q0GNJBPDigFuqhFTqgE5ZDN/TBFq9XKqcDG6bOhLmY2i6lroQeKZV5P8Mm0qRc d6B8zHh74G3ztRiJEo3tgCQ8bKGeidXiTVAMZTAPFrJoZmGr2AC7gm1g17BNoGCHpVwfnfrf bBgXfP/7JsA3OzaundMbp/Ffme8bHO+53+EIvqEbUj/5CCXO82m7UKQRI2nM/3ec+IPW9l+9 Ep0VixY2L5g/r6nR1VA/d87sulm1M2uqqypnVJSXTS+d5iwpnjpl8qSiiRMKC7IcmRkpSYkJ 9nhrZJjRoNdp1KogpUIuEwUGGeX2ihabO6nFLUuyV1Zm8ri9FRWt4xQtbhuqKk7O47a1SNls J+d0Ys4lp+R0Uk7nWE5msE2BKZkZtnK7zb2vzG4bZvPmNGJ4Y5m9yeYekcK1UliWJEV0GImL wxK28sjOMpubtdjK3RWrOgfLW8qwviGNerp9eoc6MwOG1BoMajDkTrF3D7GUYiYFhJTySUMC BOl4s24xsby13T17TmN5mTkurknSwXSpLrdiulsp1WVbxvsMV9qGMvYMbhg2wOKWdG27vb11 QaNbbMVCg2L54OBlbmO6O9Ve5k5ddzASh9zhzrCXlbvT7VhZzdyxBphbnmiw2wY/A+y8feTw yZpWn0aRaPgMeJAPccxMmO4PA/YNe4jji4vjfbly2AmLMeJeP6eR4jZYbPaAMyu9yS208JQ9 /hSTi6es96eMFW+xx/GpKm/x/azqjHSvX2zLzEDrSz+J+IPpNreY1LK4rZOztWPQXlZGdmto dDvLMOBs9Y21fCg7C/O3tuAglnEzzGl0Z9m73WH2UsqAChufg2X1jVIRXzF32HQ3tLT5Srmz yst4v2zlgy1l1EFel31O407I8x4YyreZt+dBPjTxfrjDp+OkJJUPNrYvcVtbzO24PpfYGs1x bmcTmq/J3tjRxGfJbnCnHsDm4qQWpVI4tlNy+zPzkSsTg2yNglls4rOFClsFPuylUzDBgNMl RfmMlk6xNTIz+LNhK74cPHRSPRgRE6dX8iSRF51eaY5riiP3DV0y+/okT3QHjavLgIqxPlE7 X9s1ys07lGor7ygb18GTKpX7Ouir7fT9FLgtfA1jiSA+nZX+JDERdy7qBKxGUvFZjLS5Ybat 0d5hb7LjGnLObuRj47aW5rem3l4zZ16jNNu+VdJwUozSJ1LMDXGY7I8I03ENVqSb/dMqxWdI 8bFo5SnJVf5k22CQvaZ+kFdu91UINtxBOGhFUlXrlRND8nFrVuDpZq9otdsMtorB1mHv+sWD Q07nYHd5S+ckXoe9qn3QXt84xSz1dW7jgHkdbyoEalhNQ2lmBp49pUN2dvmcISe7vH5e404D gO3yhkaPwITpLaVNQwmY1rjTBuCUtALXciWP2HiE1zQXI0FSfvNOJ8B6KVUmKaR42zADSRfk 1zFoGxZIZ/DrBNTJSOeUdNzhJEV2oonxuC23tfPpOa+pc7CliW8uCMepxB/mZvZicAv24iEm KLRutb2j1K2xl3J9CdeXkF7B9UpcGCycoXH4mTTYYsdzChdUI5gZLUWRV2kb9nobGuP2mUea 4nCpLUCZ1+hWpePZL0+sxnwzuLSgeoZ7fVsr7we4GnlZZWJVWxMuW3+FmKXKrcIaVL4aMEeF VIYvRyzUhnODEyiVX48R9/omd1M6b7RxWZO0nA1uqLRPwmmnOuVJvKGspsEQe660N3ErqBMv 41Bh36C+kTRmjGJjTWQkpRZ73mbHpLYWG1pbBm31uNTpLFWbSdOBR6IsqUMStdmXCHxYYqJG p3arHFgh/vCwxsG3pDxR2dREnZdil/kyYNsGtwZ7lDTOlL4CaB1MquJ9wZ/LsKs86294NXOG Ya59DZ4svNNSTUpMdusSq1rx8KfyGtTYJ/oLB/EzQuOrYy9plXzkWrS7mNgw7L3HvjZunMvM sPOXA1+YYN6JCxuaBk9VuOenZ2YEnarVSerBwSDd6QuQvYJ0Y0QlDKnEYeGfHkusdVj4h8eS jvjCY8lAfE74jPAppX1CsY8JHxGOED4k/J1yjhAOk/IDwt8IhwjvE94jvEv4K+Ggx6JC/IVi 7xDe9sSGIA54YqMQf/bEZiHeIrxJeIPwOmV5jWKvEl4h/InwMuGPhP2EPxBeIvye8CLhBcLz 1Il9hOcIzxJ+R83+lnI+Q3ia8BThScJewhOExwm/IewhPEZ1Pkr4NSl3E3YRHiHsJAwTHiY8 RHiQsIOwneAhDHlichFuwjZPTB7iAcL9hPsIWwm/8sTkIO4l/JLK3UO4m/ALwl2EnxPupOJ3 ELYQNhNuJ9xG+BlVfSthExW/hXAz4SbCjYQbqNz1hOsIPyVcS7iGcDXhKqp6IxXfQLiSMEi4 gnA5FbiMcCnhEsJPCBcTLvKY8xEXEtYTLiCcTxggnEc4l7COsJawhrCasIrQT+gj9BJ6COcQ ugldnugCxErCCsJywtmEswjLCJ2EpYQlhA5CO6GNsJjQSmghLCIsJDQTFhDmE+YRmjxRExCN hDMJZxBchAZCPWEuYQ5hNqGOMItQS5hJqCFUE6oIlYQZhApCOaGMMJ1QSphGcBJKCMWEqYQp hMmESYQiT2QRYiJhAqGQUEDIJ+QRcgk5hGwJIvNEOjCWRUoHIZOQQUgnpBFSCSmEZEISIdET MRmRQLB7IviCjvdETELEkdJGsBIshFhCDMFMiCZEESIJEYRwgolaCKMWQkkZQjASDAQ9IZig I2gJGoKaoKI6gwhKUioIcoKMIBIEAiOABOYljBKOE74kHCMcJfyT8A/CF1Kz7HNpROwzUn5K +ITwMeEjwhHCh4S/E0YIhwkfEP5GOER4n/AetfeuJ9yO+CvhoCccFxj7C+EdT/hExNuEA57w 6Yg/e8LLEG8R3iS84QkvR7zuCa9AvEZ4lfAKVf0nwstU2R+psv2EPxBeosp+T+VeJLxAeJ6w j/Ac4Vkq9zuq+reEZ6jzTxOeovae9ISXIvZSgSeoocep17+hyvYQHiM8Svg1YTdhF+ERqnon VT1MVT9MVT9EeJCwgxraTvAQhqhZN2Eb4QGq+n7CfYSthF8R7vWY8Nxlv/SYpiHuIdztMdUi fuExzULc5THVIX7uMc1F3OkxORF3UJYtlGUzZbmdstxGaT+jnLdSbBPlvIVwMxW4iXCjxzQb cQMVv55wHeGn1KVrKec1lPNqwlUe0xzERsq5gXAlYdAT1oi4whPWhLjcE7YAcZknrBlxqSes GnGJJ2w+4ieUdjHlvIiyXOjchjyiL7d+GFxpPaCdZX0c5Tcoe1Ae05xh9aAMobhRtqE8gHI/ yn0oW1F+hXIvyi9R7kG5G+UXKHeh/BzlTpQ7ULagbEa5Xd1p3YRyC8rNKDeh3IhyA8r1KNeh /BTlWpRrVJ3Wq1GuQtmIsgFlmkr4UjgKZ4BVOIbsBCu7wBPKt+P5nhC+tPoIvR4jX1o9hHMI 3YQuwkrCCsJywtmEswhTCJM9Bo5JhCLCRMIEQiGhgJBPyCPkevR8neYQsgkhBCPBQNATggk6 D07KMNMSNAQ1QUUIIig9Oj7VCud85N9RRlAOo3yA8jeUQzidf0Z5C+VNlDdQXkd5DeVVnJZX UP6E8ijKr1F2o+xCeQTlNpyKn6EMs/Vk6XUeI1/ya8k4awirCasI/YTphFKywzSCk1BCKCZM pSGbCGGEUI6doigKHqf1rkdFAXag7EURRaC+nEuop1mfSz2bQ5hNqCPMItQSZhJqCNWEKkIl YQahglBOKCPEE+Ko8zaClWAhxBJiCGZCNCGKEEnDjCCEO29FHkf5EuUYylGUf+IE/wPlC5TP UT5D+RTlE5zVj1E+QnkP5V2Uv6IcRPkLyjsob+Ps7kN5DuVZlN+h/BblGZSnUZ5CeRJlL8oT KMMoD+OMP4TyIMoOlO0ot/LZF46TjQcI5xGWeYx4FWKdhKVkliWEDkI7oY2wmNBKaCEsIiwk NBMWEOYT5hGaCI2EMwlnEFyEBkIWwUGmziRkENIJaYRUQgohmZBESKS5SSDYCXKCjCASBAKj HQnOO5FelFGU99GwL6P8EWU/yh9QXkL5PcqLKC+gPI+G3olyiZho/YnosF7MHNaLKte7Lty6 3nVB5YDr/K0DLs3A5IGaAVEzYEacO7B14PUBxXmV61znbl3nkq0LWyeo11audq3ZutqlWc20 qyr7XQ39B/s/7RfD+hv62/v7+q/v348K5V39O/r39ovD3j3OkP6JkyvW91/TL4RhugD9TM/V cf2a4Iq+yh5X79Yel6wnv0eY/GkPO9DDhOweNrunpUfAXNt7ElIqeO6CnvDoCkNPdo+zRzyn ssvVvbXLVdfV1XVB1+aux7rkF3Rd3SVsw5Dg7FLpKlZWrnD9eQWD3YIXDCh7BK9HVHftEkaB wYfCqNPLzkYDnIWGWOZY6urcutS1xNHu6tja7mpzLHa1OlpcixzNroVbm10LHPNc87fOczU5 Gl1nYv4zHA0u19YGV71jjmvu1jmuOscs1yzU1zpqXDO31riqHZWuqq2VrtmVbIajwlUuFlrx DQIW/Om2rLccscg0LbHdsUJ37IHYI7Fid8yRGOECM9NHXxB9dbSox4dAjyhr1NVRm6O2Rcn1 UkDUdoesDxG6jeuNQrbRaXzReMAoA+MWo6C/Wr9Zv00v1ukX6T/Ue/WybXq2Lfix4BeCxbrg RcFdwaI+mMdFgzPYkVOh11l1zhlZOnFKlq5EV6cTr9Yxp86RW+HUJSRXlGjrtIu04mYtc2qT Uis+VHvVglONCR+qvCrBq2IgMhtjwAwIMYjPETNZK3A9bg9ncoZXi6GG+vT0mmGld26NO2j2 fDe73J1Yz5/OOfPcisvd4Jo3v3GIsauahpgwvcEdxn9xLMUv2bgRSmNr3LH1je4tsU017vUY cPKAFwMQOxQOpU3pC3v7e3v70nvT8YGysBc1ff34I4HhE9nfx1P6egGzpH+N4zl6OfqlTL39 i/qxDkxAda+k5rGFUpavq+M/6r52JP8Jx37Mxv+3XeSihQDK2wFGrxv39/UL0f8MtsKD8Aj8 Bn4Hf4BPmBpa4BJ4DP4Cf4OP4RhuUyUzsRiW+sP9WX/0YvkK0Il7QMG/lcF71Hto9F7vIQB5 8DjNdRiLkCWd0HhDvCOn6kavGx0efV6hAYNU1iA8i9ojbMR7VCjhcW8hjwuX8bBU4ojy9tFt o5tP6k439EA/rIG1sA7OhQE4Hy6Ai+FSuAwuhyvQFhdg+ErYABvhKrgaroFr4adwHVwPN8CN cBPcDLfAJrgV7Xgb3A6bfWk8fjv6G6VUnnIn3A33wn3In8Nd8Au4B36J8V+h9e+DB1BHGorf j5otcAdq70Ytz8V129C7YQg8sB124JxR3B8bhj3wEDyM3ImzuQt2w6/hUZzHPTizj0s6rvHH vz4nPZ+AvfAkPAVPwzPwW1wZz8JzsA+ehxe+V8qTYxoeexF+Dy/hWtsPf4SX4U/wKrwOb8Gf 4QC8g6vu8FfSX8Ecr2GeN3253sZcf4VDmHMEc1I+yvOGlPq+VMN+LHsADrIg+IwJcAy8GOKz d6M0Q7dI88hnj8/OXZKd+XxswzifoXvG5uZ+tPH9OJ88xsObfLPxAOYdQgv67Xd6qz3vmx2y 927Mw23BU/b5bPG0byZ4PY+OlX1WSvNI5R4fq/WERWmEfxxnnTfG2fCv8K5kGbIepZ6wHs9x EPNwK/M6TrbtO1iWrM/Lcv34MjztNYwfwtPhMFqa8wNpJj6A98bC7/nSR+Dv8CF8Jj2PwEd4 nnwCn2L8c9QcwdhXtadqvkD/D/gnHMUZ/BKOj4sdPyXlOIziHANjTGAijJ4IndBKIsMrhgLP tCCmYmqmZToWzPR4FVGekqIZSzF+JUV7mjSVpAlhoSwMz8sIFsmimRnPzVhmYVYWx+LHpUWN pdgwxc4SWKIvLVwqGTVW1oo5IsblTWXZbDU+05mDZWE4h+WzAjaBFaEmE+O5GJ+EadkSS2E2 LIblcFT+vvAc1h+Gp8oQ/6630V7xdTwxRVBCEdTCLGjYDTp2Gx6rk9izO8rKgjKVj2JUABt7 FoLQfLc5Q2WCzmwusRcoNohzjFUlyg1CA5Qcf+vNp/CxL6Qoax/LenPk5RHD8aeMRVkj+0dy spkxzihJWLCgVCoU9niHUJCcVJiXl1ssFOQn2eODBUmXXzihWMzLtQhimF9TLPA4E1//sk4s P54grI2bXJ8jZ+mJEdbQoCDRatEl5tn0NbX2wpRouSxIIcqDlMmFpXbX6ur459WRyTGxyZFq ZGwM8vjj8uCjH8uDj50pKzu2W3i/qLE4QbFWpxHkqqDbUiymhJyYqTU6vU4ebI6IjlEGGYPV aZWtx2+JToxQqyMSo2MSeV2Jxyfj3X8jgNggD4NoqOGXT1fjTjAJ1zs1oNLPNUVq9GymiX86 dCoaILIkunYkvYRl7UNjmJ1fmyEnuymRDzwuPqnA6Bu5yRjH7dEgV+vVx7fFZeoseUnJuRYd uwkV8pWWVLM2OUN2k9qgVijwcexDTVQq7533qOIcnNkp8Cr1zqnRZWdHZGWpHZGR0cNC+46E HK1WjYGHIaFwTpRWE7mLZYITHN4jOwx2YWbOsPeI08ZDEQb+1NEzIis7x6GwpsyxukJcchf2 HF1IRBG/W+AYcnNzcZj7R3KNeQb+MBZNzcrLM+bhsB/8YVvx24ovEqOdBYs8lMzsxjFlPl9f FiGC5TFcVJItFedoYrMTE7JjtMLoFbIQa3Z8fLY1RBy9UdBYslAfqynMvM9Rmm3TskgZi9dZ UycmDpmTo3QJfvvKYo8d1BnVolxj0Mhijv1lTH9hXqHeXpT25XGRpU1K0AdjKf7/pzgPslqc h0Iog9toJnYYHMZU9S7hKbxyTBBu9aSWGKW/MDoMw973d/B1YcCP8tudzoipfsVU/Nz/kDNu ToTfGHy54FYbSS9iWSO5+3GXGUOKitDKQ9+vlnHWTBYdov1kM8blhkdYRBPfvRYxIiI8nOUn JSclYS6+gWW1QZZJuWm5sVpZnyklx5k2V2fJTU7Ks2gz41hdXql51sCZjjjnwimxeZkpoSv0 6tH7J5WG5WWuunRiw8SYeI1eLZNpjFoWlzMzL3o0dMyiN2Uky0RN4Zmra6ed3VAcGpxSVOXw JtnFdmdjiFwxeq05p4z/B2+J95C4QZ4IVbDLvw+nCTc9mJCbkKs187/8gtbBF90EULPMh4wT 0IdP8ZtkyjDLdGqnmeWp9eHSlgznv65xys/wb0m06ki6sagoK8swYhjhSzuER/g+3g2OH6ha tD4je8v8Bx6djA6FL64w+eaDH5WmMItC3DDzogfapvc2To7WyFR6dXDe7K6q7JkFMdm1izsX 12aX929uciyYXRymlAuiUqfRZFcsmJDuTDdl1bV3ts/KZj9Zsmlpfrg1PjrHYU2L1sSlxEWk FSdllOSkZ0919c1p3tjsCI60hAVH2KNjU6K1MXFmU2J+bDql9+LKnoF2XyX+CfLAyVLJ8h5V RP6wMH8HJCfDpGGh3GkwihHskwgWMazNZ1/ms3z++xeVVsdm5uc7pqUNs0in+UA8EwfiN8YL zvjZ8S3xoj7eGi9oZfHxsthh7wFnsBbNFxtpYLWxRx3VfC07VRiZetCprZVBZBbZcySdL+RF C5ubmxc1872Qld58zkjzObg79hahjXP53nDqf+TeSLuMv/6SkgoKfK9BPr95ONPCiZdgsUw6 rJQ01+F5uYUTxFVh6WmZqcYJG8+YsfrM7Klrd6w+05g8LbukbWaeQWPUKNQxFQu7Ji+7oSXj i5apZxRGzSgpaHJYgw1KpSF4xuTSxKrllbN6axIK00rSwmLiY4KjkyKsCbF2S2iq69IFr4Uk 5MVNdBbm8xOrBuf1OfxcloQ3ght886oxF+0S+D+wZwk9TnVoXIWmKNksC07zr3e0XZVTFVmd Ly32fIztcAbXymfyU8ZnETy98c2ABxVNher71jH+3B9vQzyixl6ZYlKSb59I+2iC+Jw6MtVi S4nSlN+0YMnGppS8xT9dVLNuCn8ZJOLL4GhhW2HOjHRTSGpZfnROXqGNDiW1XtNWPbfu0u1t qx+9tHLqZIanvUah0BjUx/PLKnPmdhRMPKs+Vx8/IYXbrRrt9hDuh3TIZ3Ky2/bQ0LgM/t8A 6fmyYW65ODEjNEMwZzwh40svQsdqQWaQCTNny1pkwhaZWybIZDFZaJHtelbL6bRhnqyDSdWR n0OwIVgwisGqSC2rVUViBtU/nTG10olyPD19Py63Ed/Kaz5nYXP6yMJm/m54Ew+sLMni/9m2 pTNNYY/zzYE0L2HBivGXOlNyoTRPSvGh1ITjb5snN08rba/K1qu0QaIgC9JNmtdXunr7msnF q+49q3vzkuxPxfmLsmdkRQnsqCOjqHlafGhEqDIkLircGq4PjowwTln3yMDqxy6pKO3fstB2 1tqEqfVZ+H4433tUfEneDbmwwv9+0AiLPLlpYcNCy3ZLWtT4F2atU+XMrE6oiJpJC8//jqS3 LJrR8+3yn3Q7kTa3Qjnuleq/2hUW0np9SRuTk5CYE6MNTShKyl5coJUWZqzWz2mXVc0fqI2P 51c+fhFkx6dVF8RWTD++za+R2/1rczTUWTKl88o2oLGzdTh2E5T4boF6nYlpNEyjZjpgGhmg DR50qg0V1H2Whd3PyZZOrmbzdr/65NH4Os/WndrL+K92xm9/3Be5cCH1YSgtdJfQAhZpGsCC 5jyyXcNqJbNq/WbVoFnTohKqxgwbUiSZNp2/gg0j/AzZCYbvVPLbzYnpX82JOjrVakuLUFff Uv8v5kQ8zx9aOnv2lKWDrXhKVHoPyWRojVBIhnPIHo9BmNCPZ6sFn2qI8i2uqGEWjZ8Uqu3S cWjnf5tzymv994eRdEYfrdAK37bEiVvG2A6U54/dKKRdKpNNWTd87mp338Sp6x4+d427d+Lo cVNufcnEhkJzeE5DcVFDYTQ71LP78urS84dX9fz6supp5w9fWNo115Fa1zUDmZk6qwtHef7o DTLAUabBVLjR9w6JK1TzaTdBunCJUwUmdWFBnEye7d9M2cOsxqlLqjZXGeqKpBEU8T91jhtB Cb0BaAFIb5GHvm8d40yRfJolQJ9B/cZRGsPDJeMAvjYWJk+bOsU2thaiUq2W1Ch1cs2s+qzF g2emjB41pk7PjcJ3iKWgJT+nPMPERlY/dmml3uqwji7w7wrZW/6FsSxlampY7aWe1UXL5ubo 4wtTRl+bXpU7ZwntG2GXdL/q9u2bJD3uVqcWovVqqzpLLepENT+ucQeoh1m9U+1Mr07Sm2xV Jmnd4xVTGvMi/h7Y69sx6n+df5xtaPRfYx+FsAvPaHVQWJQlxJSWiRvllA1iL544MUZnsUVq 5DJBrElwRKuVQUpjwpSM4/u/ukW6cqcl6UWlSq01peHoq7yHhI9x9FVw6MSt3jF2qy9zxoNW 5mCOgxPwKFO/Z5zg5AfBBNsEQZSu4vopbAr/bGmWruMH+VW8OtzA73oQzgyy8I/HFgXax3cf b5Yu5Iua0w0jzfhz0mXfafs3t/Y9PgMIHxd1XlWfO78yO1wrC9KqNOlOV2F8QXJY4tTaObVT E3MXXtaQVufMCA2SiaJSG6RKKqrJjs+1GZKK6+bUFScxy8y+Wcn6iEhTZkas3aSMskQHR6dE W9JtMfEZznklzrNnpmlDTHq9yRphjg9TmiJNwdH2MGuaLSYuw9mEsxThPSxcJRuCSXAdzdLD RqNucirYM/n/cUboMv07M3OYWbfbK2N1foWO/wdCRGUO/88Fp9JnHNyc+6SjLe947t5cI11c dkLm96mETnuZ7/cD8Un+i7Z/DdOFRME/6Yb7LyjCVZoQe9aEmJqVlfFnh4bxZXmWJpbeAo/z hRoW+oRjcpgtyqhUaBTydRlZoXqNIqluzVz226wJsSkR6qdxi8vluMWfVkekxE7IGm2uqlKq lEpTAp6K73o/EkDeiUdgKlh3Q7gwDDYwCVc9pJEnmmsNFVBS8ubzvnPd/wsN0d/h0FN/I/Y2 U0el40aLUrNorbUgJSXfqpPr4gpTUyfYdDrbhNTUwjgd+6X/zBE36MJ0CqUuVHesLnVivF4f PzE1rciu19uL+E1hwPsJu5ulgAZUHpU4E0r25WTjZxXJcPhCDGd3T2tocE5z1TuvaXaWNC50 lvA771qxXXhNvto/IpOgwAriBMVDqXJz0gzDDBzRvlwc0ct8RP4BjA1p7AgWk6QLvEl4QmWK jzbbw/Ceac6w2TLM6tHlqjB7tDneFMQiGFdOyxGv8v+KgD3mN/fotJN1JpP0F53bf0Q/csKz oW/vhcXkRUvA/xBepv6O/m7y8p4fyR/5tl6Re5LfOd4rM77GP899UC15le00/uGAD/iA/3d5 tfwbvO1H9V0BH/ABH/ABH/ABH/ABH/ABH/ABH/ABH/ABH/ABH/ABH/D/K176OzKT/pbMIBJa QAbZUMw2eV/l3wXsPQzzmMX7Dj4HvG/APLER1EzA1BFmwefHbJ4UXiU9r2DXeD/H5ybvP9gG Jnj/gM9o73v4tHgP4XNACl/Dn2Kjdyb/bmHUb8Kch/EZLYUtmLoJc3LNJu/7YiM+n5f6mCnE g/97l9ulpyj1PFiK8bAAQdJ3H9M3fk8SZb6wDCLFaF9YjuFiX1iB4TN8YSUcFVf6wkGQJh70 hVVgk3X6wmphy1hbGjhDdrkvrIU02Vu+sE64WR7kCwfDcuWWsW/vzg3S+sIMlEHFvrAAMtUd /u/phljVVb6wDLSqW3xhOYa3+sIKDD/sCythQPWELxwEJtWoL6wCg9rpC6vZ7LG2NJCunu0L a8GkPtcX1rGZ6mt84WAo1LzBvyFdpvLZmcJkZwqTnSlMdqYw2ZnCZGcKk50pTHamMNmZwmRn CpOdKUx2pjDZmcJkZwqTne8FG+Ti2s2GiRiqhWXQBj3QBb0oS6APddMx1APd0rMVNcswtBIc mDINlqO3wVzULYVOTOuVYh3IDsy9Cp/tmHM6lluOeRajbhnmWCbla0VZgXW1S3lXYqwXdSul NCq/DHtgQ2nFfMuwhrUYW42hPmyL5+nHGvtQ34Ex3ud+LN2O6SuxN7yWLl+tfZhjha9NnsOG Y+yS2uSt9EpjqZLGugQ1fIz9qO+QSvRImuVSr/t842jDlAyp5hWSZrlUYyvaiPT+VlZgPcsl i3X7erkSNSukVqlOPs6+cT3gLXZLYyF7+61NfectdaEFbDh+sjjv1QrM24rt90kxPuK+sfkg m1ErNqnvK33j6pJsu1jKeaLH40fErbZGKkejPhvjDmk9jJ/NZKm2FVINayU79Ptmfry9+YzR +Duk/vPx07z0SKuBk1rkc23DOrrHRkN9XOrL04uxdb7a+3AUNEOrxmapVVojrahdcdK4/Ku5 DXvSKrXf5mvfcZpVP+kr47RBKaYtx9omje2YAjjDt4KW+dZaAdZWiKknl80cK3v6ndDhW9M0 wlbfmJZKqdTHDp8Ve6Tvru+Q7N2DM2KTVgmVOX3qku+0q0+sIJovF8aW/T/izgQ8qup8+OfO TGbNAjhAghRHcAkKARElhYg7KmtAsICtTEgCCWRjMhkyGDZFXIqIlCpaRLSpC7SIVtu/2toE BAlhSYXERIWGoAE0xAQvAYGP+/3OmUlIgH6l3/M9z5fz/O7c5Zz3vtt5z5kgonSQ739QzQB/ h9gOCGuQ286C1PBc9Csr01V+j+ZOqohXce9LnzQl/z6lVWisn5aHdwfQ5qqWoOZ9R80TlPRs +vjJN6n/TGVBHhKC3JVRnaFskbOpo9TW+7KihCIwu03eFKVzKJODKgPzlYZ+NdfyVW0IjfYo G+Q8TVdZlqneEfLQdDW21Xv34r/RVMnQWF+7J6E5nqZ8cn7ezlXvSlXz+lLvDV3LvqlkUYHy YVrbPEhTz2WlCVnQmvt5ytKccPaHZKWro5zNF9otn4eqRjyj+qrszMau9LZ5fLFWORdJvnwf nZfeWrk94dobyp7UDjXwYtvP52tHvYa184C0JGRLaCVozXpf26qSpupqjqqvKf/W0pCfUzr4 ND2c/RfOAelVmXkFamSaqlHSmvQ2ObJnlqpz/6cI/b+aF+fnxACljZwDodUpQcUqTxS+7Rk0 cGCiZ0xmqi83P3eG33N3ri8v15fiz8zNSfDcmZXlmZA5M8Of75mQnp/uC6SnJdydkpU53Zfp ycz3pHiyc9PSfTme/JScfA/PM2d4ZqRkZ2YFPXMz/Rme/ILp/qx0jy+3ICctM2dmvieXrv70 bEbmpHlSc3056b78BM8Dfs+M9BR/gS893+NLT8nyZPp5R2p+P09+dgoapKbkcS6HZBdk+TPz EJlTkJ3uo2d+ul8JyPfk+XLRW6qN9Kys3LmeDBT3ZGbnpaT6PZk5Hr+0A80Y4snKzOFduTM8 0zNnKsGhF/nTC/0MzpydnuAJm3l9vic7JSfoSS3A+JDe/gzenz7X40vBFl8mZjMwJdtTkCdf g8SZ3MnPnEd3fy4GBaRJKZ65Kb7s0Lukm1MzUnwolu5LaHP90NZ3eu7KzUobKgNzy0M4CJM8 tyTcOij8tL982i4I6XiaF6bwppmZUqN0VPSlpKVnp/hme3Llk3aXMy4dauUg7JqUk+ln/IP+ FH/I2gEIyFUvSCWKfl9men7C6ILU+JT8vp60dM99vlye+v15QwcMmDt3bkJ2q/CE1NzsAf5g Xu5MX0peRnBAqn9Gbo4/P9xVns9IwYDZst+U3AKcHPQU5KejBCbJx54UYpruy870S4WmB5V6 904afSdPfeqCiKcVhGI7NyMzNaPdWD4zc1KzCtKkL3I9aZn5eVm8QHo/z5dJh1R6pef4Ezyt 787NITXiM/t60rOny0HnReW0dr6kRqq7TG7cn497UkMZ2PZ25dewrGFKgfhM3sIkkK73yamS ljs3Jys3pf1L0TklpCmOb4tAboE/r8CP2wOZqemyT0Z6Vt4FBl1OLFQkBqSlz0hhOiWk5OcV tv4bPcYY8dHF/28e9T3MzPcOp4gRNsPgaAp/wxJaPJ9eIdq+u136Z7j5xchIjT7aU5fbPypK 9T9yuf1jYmR/0/2X279TJ9X/rcvt37mz7G+2X27/K66g/3D1r0nZ+b4n+8tv2V2E/E59j4gS U0Vv8YgYoJlEktZD3Kf1EhO1qWKaxq5RC4igNl8s0Z4Wz2nLxBpthXhTe1m8Zx4pPjFPFuVI /RwpX14g/8B/kD8J+V7k5yC/CPlPIn8l8l9F/nrkf4D8zcivQOoXSPlXR/na39vJj0b+tci/ Gfl3In8M8n+J/Azkz0X+UuSvRP5a5P8J+R8ifyvy9yK/DqlHkXK8o3zTO+3kxyA/HvlDkD8C +ROQPx35OchfgPzlyH8Z+W8g/wPklyJ/F/K/Qv73SD2OlDMd5ZvXt5PfCfk3In8Y8kchfzLy M5EfQP6TyF+N/D8g/z3kb0b+HuR/jfzvkX/W/KL816K0yI7yLX9pJ78z8hOQPwr5v0T+LOQX If8Z5K9B/kbk/w35O5D/FfKPIv+keaRmM0/W4pDvQf4Ncp7ZLcIeURL6abI7hN1ZuugQ7eSi ykX7F5XR7FZht53aufNU9c6dO+0Rwm7N217SVBi7Os8aIazWptjC6upCdT9WnnKh7udVnyop Cd1HsrxfbZe/rwi/qyQ0WN0P9+cnz952t4kuZmG11IZ6W4Q1Iq+kNm9grc1i2CzeJi8/A+0m zW5RHURJickkTIg3mzV7xLp16+wRmny1+jlld2h218WWaf/ZModVOGyRkZFF9NlZZLUKq61w 59mSkiL1QMqWD3Y6TMLRZluJ6hZ6EB7BT6G97e6psEVNFxqnwuENW+cwaY6Qde3NixAOK/5x RGiOVvNKTjlcmiOqlp/m2n96v6Lt8O6mOayawy7fqEyUQ2yYWJuXiI02q7DZCpdJw4qcVs1p bzVyZ5HNqtns6Hy25NNC9ajNzJ1Ok+a0tNlZonqGH7WOkqY6z98/JbtZNFvYWHVuVdYOrHVg DOaekuZ6E6Xs1lxUBmsmXmWJ0Jw2mRFSE1vri8+edUZqzujavCZ+ajbJtmfgnoHbaE6b5nSc Pbdt21kU2LZNGVB49tOSU0WRy84WhjQ+i6lni1w2zeWw8hOg97ZzgZAFZ7E7/Ey+6Wv5bNs2 l0lztTO8xGbTbI7wM3VepGQUOdvun/tadovAWjkV2ixvKvEObFKWW7Fcml6YKIW3Wt7RdJcy 3WXlpOS87a4ozRVTm1ib2FTYpObcrtW7Vu9Z/VnsZ7Euu+ZySuu3nT27bduWLXKoMr+2sKe0 XyY918sI9dmsSJsWed4BeMBu0+zSknMlm88VqachF9QrOyNNWmR7H5So7q1PW8cqN7hCT7a1 +kHNxupTodksL2yFp+RcO9XkjBDOVk/gikiTKbItr1t9EaF8Eal8IbWyn1fh3LnIaC2yc23P 2p5NSU1J1VnVWTLrPlv22bItkVsiIx1apOucMMQW1c6Js2KbOitdVLpIGZi0YDO+SYq2Lj1b 6LBpDkxYal0gnRFl16KcZn6GLTy8ZcuWwwuHOeyaw5m04PAWo+TgwuHqudThgHFoi/qJMmlR ESXtf9SItudt45G2IClSXn19Tl0pJ6kJ2uqkEjV5iRyBI24umQutbsJPUSZT1Hk/tXNURIQW ZVd1Va3aTvG6abIwpwZ9WcI905c+WwzNSvHniNE80R6ccJdH/luE7Lrk7sHKuu4OX2nCxirc Vd0P3aF6s252o5kfSE6+X1wzYdwYjxg4ccIoj1yVVB+5j+uk/l+JBudO1qlW6RbhYvWKC19F iEhxheghrkzNy88Txeq4Xh03qeNf1PFv6rh5Nl8CxXZ13K2O+9TxS3WsVcd6dWyQ30LEcXnU rOrYQx0T1PEudXxIHWdlz86erS1Qx6XquFwdX1DHter4hjpubNuN/aejdplHO5404wPqL+fy N+v//+6ZiEPUf/0ZLXqx+5igfuP1mFgpXhfvic3sGevEcfYjDmWpPWxtg5B/viD/NU23+pdf 2XNoQ0OfT+0Lfb7ycrsx5NvhHh2utQh/x2vr2o7Xjmc6Xkd26XjdK9Dx+uoLnvde2fG631vC YWp33T+r3XOr0G5/v+P1vSY+neR0vEjGnmjGPIarBpqSxUJTsekLsc78ivkVsc/it7wmKiP2 Wp/SzM4HnSnah84nXZq2PbJT5L2muyMfjlxrCkalRc0y/T1qYdQy06fRpmi76fPok9EnTTVC W5wsfWPdG7Xpkm0HbV/UgXbtm3DbcYnWGN2zrfWmDaYNp6WptvLCFrUjek30xk4rwu3ldq1Y tdOXap0tnUe2tSWdl7e1plDr0u0SLZ6W4F7Vrq0NNfXkgub+o3tzW9ve9UtarWrnLtW6xHeL 7Na7+5Jwe6ZdW6Xa5ku2iu6nW1usO7ZHW7sn3EZesiWr9lD4s2NbFD7KfttU29fWQqMPxDbF 3RCXFrc27i3ZLpQet/FSLSQ97n/i6sJNP9/kW+JOq3ctkvxsdJ+EtnZHnxFtbXK4PULz93nk mutog6/tfW1in0c49r72L9f97fodqh2JH0tL69uD5ulb1bcBqvoev+FvN66UrW/VjZtuPEA7 1c/Uz95vI217wiDaPQljB6wIt/du8t/c4+avBy+9NZ42aEjkkLFDshLfCLdNiR8lbh/ai9Zv aGDYzqQW2W4rum2jakeG9xq+KtzW3naE61XDq9VV9fDvaKtud98RuKP4zm733kHbdl/ybUWh 3nxWh3o9cJ3s98DgkU6cet3IFaOiVUscNUE1fbRpdOzo3qN0zpJpM8aIMdYxaWNaxrSM7Tm2 nn6J4yaOmzg6meN0eUbLGOcbtyjZqlq/5LGqeZNzwJtcmPxYciHPfcnV46eO944/Pv74hE4T 1tKvH8/UkwmnkgsfnP5g1qTdv7hnctWvVvzq5V8Vz3xsZnXGQxmFrZ8Z6zPWZw7MWZ6zLq9l jpgzfI53zqw5/jmPzdk0Z/Ocb+Y0zjnls/rcvht8g313+ZJ9jfmd8q/Lz8tfkL8if1t+rX+o f6L/PX9tQY+CfQWnAwMDMwKFgZcD78/tMXfi3PcKMwqfKXy/cHdhbdAZ7BkcEVwR3DHvmnkj 5mXMmzdvybw35m2a9/mj7kdHPLr60fce5ftQUWzRyKK0oo1FR+bfMN8/f+P82gW9FgxeMGvB UwuqFroXTl341sL6RT0XffJvqtamCytTx7qz6JvzTVaUxdHnW6iW/JvZN/LCOddxpoRy/ZL1 p7UGtWsdq8jiweebrA+L7zrfQpVBVtNOxbHbuq+iIu8bXk39VNVYfVJ5O4+k0q6MXtNpRdSO 1urZeXnUvs5NfSbLsVGboleer6IhL1Gnh6tKHOrVM3pNq/fkXVWVZd998rnqH/YgcjdFHaCm r2HEPiVtB9qt4HOfaufXiW8uWB+Gt1sRzq8Ja6TeF60DxReuA9R+S7juL2mt+EoOo6OHc76y tRYSj7fC8aI6hSpQqMKF40hVpAbKqE1uq4+tEaXKxY6U/c9HuM8I5MjnOveT4+q4vigbqIH7 2lXTS9TY9jX14noartrbVB6FKugdrbVT1nTujJByuR4Rm3xr/LiJXc+FVjL1yarV/TRr1blu kaxD4ZWndUXp0q3rufOrTygf5fom+3c9J3swenO3SPlE3lFrGXfksy7dona05mlsD57X8gZk dF+irtT98ytq+zVV6qTWz9YVtG0NZc2MvMSaueqiNbMitFKyRrpbbeH56ZAeSpMloxK7fhl7 D7p1iIb04oUzt9XjoRkpfRvKmD6T8f5IGVvpl9hk9yoV+bdkpNrN7oS4jV26ta21+8JSF4Xy QcYllF9xG6/tfc11IUKr2jXXqZWoXZOrWmhFU2vi/2VT62i7dnEPtbq2a+FVtq1dPEKtrv9V U+vvZbe2VfrftAs9JVvb2v1vmlrNL7upHcZltgu9o/Yl7drF/lP7lXZNZnoo0v9du1jyf9bu 8lrIz3K/Er0mqWWk87YjUfvkTke1InknqUXubuTVbUUjnXLfE3omG7umfnKnFLqr1qLvQk3t iO5Quym5b6oeXq32RHLfVM2IIrUfsbbtW2Trl2wdNz3ZKvcs6qpfeGcTOu/HvidD3lG7G8bJ T9lkf0ZYlTSvetpPHuM20ruf3D91ixwVPW663GvJfZZqiepOtNxnqavEcdNlJQo/o8kyIXdk aodmUnszmuzPCLmDo6fcjZ3fn41KHP6d8scR6Ynxx0N+SGpR1qBvSM/RyVKy2u+ZpKyQ3I7z 8OJ4ts+C63eEroRVKzF2m8cYfzRPEnHmySLG7DMOmz8RfYWJJ+VcVauzBvMk47DQOP4kTBz3 micbe/luvsFoEZ8aLZpX9NFSxCRtOp+pIl5LE7202aIXPcfTc5o5yygTGnK+FRb6xtC3F31j 6OtU8hro1Swc2iOiB8/783wazwfwvD+yBiErntFvKn1cnL2Hvr3MRUapeb7xKvrebD5kvGb+ RvQ3fysGmQ/z7KhRbf6Ob7ut2tYJC2dXcdYLbTYgaa8oFDHiFtEJhoqrxTBIQ346zIB8Y7/w o1UBBGAuFEKQb7jzjK3iUSiC+bAAHhdxYgk8AUvhSXgKnoZn4NewDD7kG/hHcIrzc2CIOE2A BskiURsPE+BBmAiZYpy2TXTH4mnmh0SS+WERaZ4GWSLHvBBLF4s+5sdFL8urxlbLOngNPhdx lr2wDyqhCr6AaqiBL+Er+Br2i7iITkZ1RK2xNeJ7YYlo4PwYNBlbrRHiFmtfPm8WV1tv5TPL qLZmQw7kQoGx3xoAfGPFN1Z8Y50H+Mb6jki0boK/wkmRaLtBdLfdCNNEnM0L02EO+CAIi2Ax 4CPbCngeXoXXRLxtA5/HoBGaoBmOw0nAh/ZUSIN0KBDdHUIkOtyiu8rdRvlfIauzo0T9lOhK 1u4ga3eQbX3ItlFk22Nk21SybRrZlky23U/vEvLlLvND5MovjPXkzSTy5ikk+M2fGC+bD5Fn 3wqnud74h/moGKXy7DC96kXntlnxiEhqJ38a8vORPwn5d9J7elj2p4y6DdnrkL0hLC9ZRLeT 4kTKEKTkICUJKUnhOTEELQ8j6UEkPY+UZCT8Q1n6V3UWi4y/I+PvyIjXphkfIScJOZnIGYWc qcgZoWUanyMrSVttfMDIj5HXBXlBNMtHZg80CyJtpbnOaEa7T81HmFlHybnvwjM2qt2M7Y/U QeHZL2dsJSP3M/PGGK+Qv65QhZG/0+V+jXhJPG40iCXwBCyFJ+EpeBqegV/DMthhnBHlsBN2 wW7YAxXwT/gc9sI+qIRq2G+cEwfgX1ALB6EODhkV4hv4Fo4bX4gfjYNChxPQAifhlFEpfmJO n4YzcBb+F5xDF8No0ARoqirWm6caTeZfGi3mR/j0Gi2Wz40Gy17YB5VQBV9ANdTAl/AVfA37 4YhxxnIUvoPvoQGOQSP8AE3QDMfhR9ABXSznwGDOdjEqbHcYZ2z3wkgYBWONg7aJfE6CqTx/ GB4xttqmGQ02L0yH2Tybw6cP/JzPhUIIcl3E5yI+F8NSzp8E4mB7js8VfD4Pv+F8FfwWXoAX kf8q91/nvJjzDZy/w/nHQIxsxMhGjGzEyPaVcc72NRAjGzGyESNbLToehDogRrajxhe27+B7 bGmAY0alrRF+QHYTspvhOOj0JXa2Fu6f5JoY2VMhDdKJl0ksF24idVqYxXKjpm31iuDqQ67k 3y6YT5ZXm/eI3kLjbou4h8ysIjOryMwqMrOKzKwiM6vIzCoys4rMrCIzq+h9gEw7Q6adIdPO kGlnyLQzZNoZsqiBjGkhY1rImBYypoX37eJ9teZfMRNSYLrxrTnV+JasqSJrqsiaKrKmiqyp ImuqyJoqsqaKrKkia6rImiqypopIthDJFiLZQhSriGIVkWshalVErYpotRCpFiJVRVSqiEYV Xj+D18/g9TN4/QxeP4NXG/BqAx5twaMteLQFL1bhxRa8WIUXq/BilZqxu4QNXyYyk62sva+w 9q42V4irzf8UXcysNsq/h8P+Paj8+zRXP+fqbvxbKPcWYjLrpJt10s066WaddLNOulkn3ayT btZJN+ukm3XSzZv6s1b2YK3swZw9wJw9wJw9wJzdz5w9wZw9wZw9wZw9wZw9wXoaw5ytYc7W MGdrmLM1zFniTbV9SMQzT48xTxuYp8eYpw3m6aKfORWyRFp4Hb2KddTN2ulm7XSzdrpZO92s nW7WTjdrp5u1083a6WbtdLN2ulk73czFGuZiDXOxhrl4gLl3gjl3gDl3gDlXwxrnZo1zs765 Wd/crGtu5koNa5ubta0Hc6WG9c1N/h8g/w+Q/wfI/wPk/37yfz/5f4L8P8H6F8P6F0P+15Dz B8j5E+R8DWugm/XPzfrnZv1zE6nJxjGZ9djI3GaXtpzqPYm16yHjAFX9dzx/inh8wNM3yPlB 5s85Z1aaK1nHZAy/oPd+elVTqZcbC7gKMraGsfJuWngd3MXY/ozdzbgRwkrPN+g5n5519PwX PWepXZbMnPVK0sM8H8Pz3TyXOXIXkpbx9DUkxSPpUyT1U/0b1G7xkDq2sP7FsBecClmQDbmQ B3PAB354RgwQnbUSNdfXIH2lfLuK7Dr4WAw2l0Id+9xDYgR7xRjWbzd7xTjzET6PsrP6jnvf szMzM3I3I7qxs4yTKzvjs0QS69hU9l0Pi2TzI2oPxiqNZvFoFo9m8WgWj2bxaBaPZvFoFo9m 8WhG9vGOh9mxPcLnNJGjRroZ6Wakm5FuRroZ6Wakm5FuRroZ6WbkIEbeychBjLxTjYxhZAwj YxgZw8gYRsYwMoaRMYyMYWRMeOSo8Ei5R3mYiE1jXkkff6R2CqfxVp38ez+s5eNhAjwIE4WD HZyDHZyDHZyDHZzDIf+ukAUPd2HMLPl3stR+XMboG7FPizcOaX3hBrgR+kF/SIABMBBugkFw MwyGW+BWGAKJ8HMYCsMgCW6D4XA73AF3wl1wN9wD98IIuA/uhwdgJIyC0TAGxsI4eNmo034H a2AtvArr4DV4HX4PxfAHeAPehLfgbVgPG+CP8CfYCO/AJngX3oM/w/vwgfEjHqnTSo392mbY Ap/CVtjG/c+MKm07lMEOKIed7Cd2wW7Yw7ydSuY+Yuy1bDV+tGyDz2A7lMEOKIedsIvVYDfs MaoiOht1EW7jUERX6AbdIRbijEPW5+Alo86KD6xrjQbrG8aP1jfhLXgb1sP73N/C56ewlfMK o8q6l/7sW6wtxiHbz4w6Wy+4CjxwtfGjrTf0gWvgWriOleN6iKdu9YUb6Hcj3ASDuL6ZZ8NY bZL4nGD8aDcZh+xmsEAEWMEGdnCAE1wQCVEQDTHQCTpDF7gC3EadvSt0g+4QC3HQA66EnoD+ dvS3o78d/e1XQ2/oA9fAtXAdOg1i33Az/JyVbygM494dMALug2m8bzqfM3g2k34ZkAmzoAAZ 82EBLIRF9H2O+7+n/5v0f8vYb3+b6/VwnHsnjEMOzahzYKvjCqPKgR2OrkaDw0MOFWomssUM FogAK9jADg5wgguioJNxWOsMXeAKcENX6AbdIRbioAcZ1ss4pl0FHrgaekMfuAauhevgeoin 1vSFG+BG6Af9IQEGwEC4CQbBzTAYboFbYQgkws9hKAyDJLgNhsPtcAfIenYX3A33wL0wAu6D ++EBGAmjYDSMgbEwDpKNo9p4mAAPwkSYhH0PwS9gMkyB+diyABbCIlgMj8HjsASegKXwJDwF fOvQVhintedhJfwGVsFv4QV4EV6mZv4O1sBaeBXWwWvwOvweiuEP8Aa8CW/B28BqqG2AP8Kf YCO8A5vgXXgP/gzvQwm1vBQ2wxb4FLbCZ7AdymAHlMNOo5Eq0kgVaaSKNFKln6RK57IOxFH5 k1gH4qj+SVTtLyxUPAsVz0LFs1DxLFQ8CxXPQsWzUPEsVDwLFc9CxbNQ8SwbjWOWd2ATvAvv wZ/hffgA/gc+hI/gY/gb/B0+gX9ACZTCZtgCn8IuEWPZDXtETERn4Yxwi+iIrtANukMsxIlo 6zLjmPVZqtBznL/A+WrjsPUl4bQSA6pZo3Udz7DF+geeobMVna3obKVKW98xjlo3Afpa0Zcq 12j9C/3/yr0Pef4RoK8Vfa3oaUVPql+j9TP67OBZOdc7YRfshj1QIWKse3k33/CsfMOzVnHv C+M0lbLR+iW68a3Oepix33PewDl7bCt7bOsPwDcXazP9j8OPoMMJaMG2k8ZRW7RxzBYDnaAz xBqnbXHQA66EnvAz4bT1gqvAA9exK7we4qEv3MS9QXzeDIOpvENgmNFoSxIxdpOItpvBAhFg BRvYwQFOcEEkREE0xEAn6Axd4ApwC6e9K3SD7hALcdADroSegJ529LSjpx097VdDb+gD18C1 QJ2x3wj9qIj9IYHzgVTOmzgfZDRSiRvtgzm/FYZAoqzM2DEURnM+BsYah+3jGDfFOG2fhm4z eDaTcRmQCbOAb7p29pX2uTCf9y6AhbCI/k/zPuY8lbrR/gKfq5H1ErwMv4M3kfcWvM3z9bCB ezr9TjD2jHHaIYyjDk04HXYqNz50OPnszP0rRAzVvNHBquTozr1YiDOOOXpAT/kbSTm7w3up p5mVdWpf9o+2+0u4/7j6DYrcYzWLCNP9xkPmMfI3U8Ipf6ulnvUzDTTqTYNhiHHYdDuf9xv7 TA8YW02jYIxRgaRqdhT17CjqnZONrc6p8CTnT8HT8Az8GpbBs7AcnoMV8DyshN/AKvgtvAAv wmp4CV6G38EaeAXWwquwDl6D1+H3UGzUR95o1AszmraYJvNtWOo/DP119NdNQ41q9NdNd/P5 tHHQ9IxxkLrloWZ56LnV+aBR7ZwID8EvIdU46JwFWZADeeCHJw0d23Rs07FNxzYd23Rs07FN xzYd23Rs07FNxzYd23Rs07FNxzYd23Rs07FNxzYd23Rs07FNxzYd23Rs07FNxzYd23TXSOOg axSMhjEwFsZBMow3DmK7TgyHGF8QoWqTiqPxsfpdxFXYvgG7N5geNj42pUE2PG2U4YMy+W0E 2zdg+wZs34DtG7C9DNvLsL0M28uwvQzby5yFxsfOIDwKi+EJ42P0KkOvMvQqQ68y9CpDrzL0 KkOvMnEnEQgQgQC61ROBAPqdJoOayaBm9PwSTerQpM486dxJ9I0Jf5vpH/420z/8O8JqsquZ 7GpGuzq0q0O7OrSrQ7s6tKsjMgEiEyAyASITIDIBIhMgMgEiEyAyASITIDIBIhMgMgEiEyAy ASITIDIBIhMgMgEiEyAyASITIDIBIhMgMgEiEyAyASITIDIBIhPAA3V4oA4P1OGBOjxQhwfq 8EAdHqgjMgFxN17w4gUvsdiDF7zEY4/pftED66dg/RSilcC319fC36FvDq+rA8Lr6oDw92Iv sdpDrPYQqz3Eag/emII3puCNKXhjCt6Ygjem4A0v3vDiDS/e8OINL97w4g0v3vDiDS/e8OIN L97w4g0v3vDiDS/e8OINL97w4g0v3vDiDS/e8OINL97w4g0v3vDiDS/e8OINL97w4o0peGMK 3piCN6bgjSl4YwremII3puANr7CRC81Y3BeLF2DxfCzuioW5WPiwiMNH7+Kfd/FNBb6pwA8x +ED++dF67H8X+9/F/nex/13sr8D+CuyvwP4K7K/A/gr0qECPCvSoQI8K9KhAjwr0qECPCuZK Jp7uWO+Oi/6m8WTpZGpdJnVuFjVuNmRBjlGpfnPRWuvmUzMWGltdjxr1riKYDwtgISyCxfAY PA5L4AlYCtRGF7XRRW10URtd1EYXtdFFbXRRG13URhe10UVddFEXXdRFF3XRRV10URdd1EUX dTHaAU5wUfM09dsvqbvOHK9hjtcwx2vwmwu/udTsKTRqmLs1zN0a5m4Nc7cG3XV019FdR3cd 3XV019FdR3cd3XV019FdR3cd3XV019FdR3cd3XV019FdR3cd3XV019FdR3cd3XV019FdR3cd 3XV019FdR3cd3WXNmmx8jber8fDHbTVLWvS1GIRFxTz/lueniUYL0WghGi30/ZK+A+mbxExx Ymk8M8WJtfHk0bOy9hOhFiLUgpXFWFmMlcVYWYyVxVhZjJXFWFmMlcVYWYyVxVhZjJXFWFmM lcVYWYyVxVhZjJXFWFmMlcVYWYyVxVhZjJXFWFmMlcVYWYyVxVhZjJXFWFmMlcXiFiwJEptd xGaXKVN0Iz67sCCdGdDADDiEJc9iSU8suQFLemLJDViyHEs2EbtdxG4XsdtF7HYRu11YFcSq IFYFsSqIVUGsCmJVEKuCWBXEqiBWBbEqiFVBrApiVRCrglgVxKogVgWxKohVQawKYlUQq4JY FcSqIFYFsSqIVUGsCmJVEKuCWBVkHk9W8zgRKz7HivfDfx4r9xVvCBf2lmFvGbaWYVdXbOrK k3ewpwx7yrCnDHvKsKdMWE0FxDhABs81jpqWMPpZ1offyt+xc/cn0xKjRWgcT4q+9DhpKuRe UN3fY1oqHKYnGc1e3vSC6GRazf2XjJ9cV0JP+Bn0gqvAA1dDb0iDdJgBMyEDMmEWzIYsyIYc yIU8mAM+yAc/FAD6ueYCOrnQyTXP+EnZ8xOa1pvmGz9gy2HTKqPR9CL6TzX5qGv5UMDdQqwM wkLjc9MiWAyPwRLxM9NS4xPTc/RbYew3PQ8r4Tew2tiOfdtdJmqZGSwQAVawgR0c4AQXREIU REMMdILO0AWuADd0hW7QHWIhDnrAlUYzPmzGh834sBkfNuPDZnzYjA+bXUONz13DIAlug+Fw O9wBd8JdcDfcA/fCCLgP7ocHIA070mEGzIQMyIRZMBuyIBtyIBfyYA74IB/8UAABmAuFEIR5 xnZhIXMO4sVavHjU9IJxhlxaYnxHnpwUyURBJwp6u0yqZMVpZMVppEcjXtZNcpeWajSywjSy wjSywjSywjSywjTifR3v63hfx/s63tfxvo73dbyv430d7+t4X8f7Ot7X8b6O93W8r+N9He/r eF/H+zre1/G+jvd1vK/jff0/ZvBI9BgFo2EMjIVxkAzjIQ0Z6TADZkIGZMIsmA1ZkA05kAt5 MAfwDd7V8a6Od3W8q+NdHe/qeFfHu7qw491/keEtZHiDaQE5vES48XYd3q7D280iDx+X4uNS Mr2enrvxdT2+rjfNY6bOJxILGLnQaCLzm8j8JjK/CSlW4lBOHMqJww+m5VTMFcYhZsAhZsAh ZsAh5tI+akMZMaokRpXEqJwYlROjcmJUTozKiVE5MSolRqXEqJQYlRKjUmJUSoxKiVEpMSol RqXEqJQYlRKjUmJUSoxKiVEpMSolRqXEqJQYlRKjUmJUSoxKiVEpMSolRvXEqJ4Y1ROjemJU T4zqiVE9MapnhjQxQ5qYIU3MkCZmSBMzpIkZ0sQMaWKGNDFDmpghTcyQJmZIEzOkiRnSxAxp IsblxLicGJcT43JiXE6My4lxOTEuJ8aVxLiSGFcS40piXEmMK4lxJTGuJMaVxLiSGFcS40pi XEmMK4lxJTGuJMaVxLiSGFcS40piXEmMK4lxpcgkgg1EsIEI6sT7Y6KoE7mvidwPRK6ZyDUT uWYiJ+Pfnfh/SPQaiF6D6dfce5ZIP2dsJILHiOAxIniMCB4jgk1E8EfyZC9RPEIUjxDFBqLY QBQbiGIDUWwgig1EsYEoNvxv4u49Tur6vvf4b3eG3WWYZRJFo8ZoLMZbarybJiZNbU9LU2Oi SZNS05i0wTQYq7mA8YY38IIXEOVm8AIRUViq1ogpSwJBEPE2rCwuQ8KwC25mZt1hx98uLLJE vuc5E+IxOe3jnD4e59Hzx+vxm5n9ze/3/b4/95EZWbHMimVWLLNimRXLrFhmxTIrllmxzIpl ViyzYpkVy6xYZsUyK5ZZscyKZVYss2KZFcusWGbFMivFrBSzUsxKMSvFrBSzUsxKMSvFrBSz UsxKMSvFrBSzUsxKMSuVWanMSmVWKrNSmZXKrFRmpTIrlVipxEolViqxUomVSqxUYqUSK5VY qcRKJVYqsVKJlUqsVGKlEiuVWKnESiVWKrFSiZVKrFSKTmWlQVYarEXjlCjDCjErDLDCAAsM skB1bhqg7gB1B6g7QN0B6g5Qd5C6g9QdpO4gdQepO0jdQeoOUneQuoPUHaTuIHUHqTtI3UHq DlJ3kLqD1B2k7iB1B6k7SN1B6g5Sd5A6A9QZoM4AdQaoM0CdAeoMUGcgOklmGJIZhmThbvU8 VX+nXdxV8x+r93g25vr7/WFIxA2JuCERNyTihkTckIgbEnFDIm6I1kO0HqL1EK2HaD1E6yFa D9F6iNZDtB6i9RCth2g9ROshWg/ReojWQ7QeovUQrYdoPUTrIVoPRd+mdRetu6y4bMXV/FUU BUVRUBQFxZr+v4uA6bz8HtlwBu7FfdDB11c/2fjPvb2LPbrYo4s9utijiz262KOLPbrYo4s9 utijiz262KOLPbrYo4s9utijiz262KOLPbrYo4s9utijiz262KOLgmUKlilYpmCZgmUKlilY pmA1GoqioSgaiqKhKBqKoqEoGoqioSgaiqKhKBqKoqEoGoqioSgaiqKh+H8RDQUWKrBQgYUK LFRgoQILFViowEIFFiqwUIGFCixUYKECCxVYqMBCBRYqsFCBhQosVGChAgsVajW+oivdHp39 bvaaKePoJWlfpv1/T0YZh0vwLfwzvo3xYHN7LNtj2R7L9li2x7I9lu2xbI9leyyPqPrCRFyJ H4K/2WPZHst63Cvt6H/FTFnE75Jvq5E+KKcO/p9iRO9+pR57Cj++lb/e6fFdeqXppu/Z0UHR 5ynXR7m+Wlc+Cdc7a4rjVHn/Dpj7xGa1OsfedWKtu53l8dzQT+F+3l3h3RXeXeHdFd5d4d0V yvdRvo/yfZTvo3wf5fso30f5Psr3Ub6P8n2U76N8H+X7KN9H+T7K91G+j/J9lO+jfB/l+yjf R/k+yvfxvgrvq/C+Cu+r8L4K76vwvgrvq7BMP8v0s0w/y/SzTD/L9LNMP8v0s0w/y/SzTD/L 9LNMP8v0s0w/y/SzTD/L9LNMP8v0s0w/y/SzTH9tWtlDqZffnVviKFGba0zSrLQv+jJtO2jb wX4V9quopbv9dStLjKBvib6lWv6bzkozZZRZOqW5Otj7Qw9dS3Qt0bVE1xJdS6lqbagPHXTt oGsHXTvo2kHXDrp20LWDrh107aBrB1076NpB1w66dtC1g64ddO2gawddO+jaQdcOunbQtYOu HXyqwqcqfKrCpyp8qsKnKnyqwqcqdC/RvUT3Et1LdC/RvUT3Et1LdO+hew/de+jeQ/ceuvfQ vYfuPXTvoXsP3Xvo3kP3Hrr30L2H7j1076F7D9176N5D9x6699C9p6ZxVfdeGr8dHVS/jCev Ds/XP8cv14QJ9S+ER+oHwi/rd4c76veG1xLNYUfi5NCbOCU8njgzdL3775S/Eh2R+Lsoc+Df K+9grYWs8YQIe473r9HDrmWJ5/GCSFvPMi97nNWLbmLJ1x07UIoOqe9RxXZ736D378GQu0Wh M9GIJqiN7l5MnOb103EGzgpvJc4Jb6S/EcrpS8KL6e9Afkhf4UiNNDXS8kH6WsdJoZS+Hjdg stfu8trdmAbzTvo+r83EHI95T/oB11gYBtOLXf9JPBV60/+Gp732E8+XO9pTus1rr2EjNnue w6883oou5+0MnekB7AmdzaNCqfkQHIqj8WEc6/VLw4vNN3lsXc23hZ7mu0Nv8yzcj0d0LH9z QNXtbLSPqpupmqdqnqrvUHUrVYtU3UzVfqpupupmavZRs0zNMiXLlCxTskzFPVSMqRhTMaZg hYLbKbiZgpspuJ2CmylYpGCRgtspWPwDBbdTME/BPAXzFCxScDsFt1MwT8E8BTdTr0K9CvVi 6sWUq1AsplhMsZhSMaViSlUoVaZUmVJlSpUpVaZUmVJlSpUpVabU5gNKbadUnlIxpWJKxZQq R8fULwnj65eFpZRaxwd/Q6EnqFKq3xa+z89urO8Ji3j2+PpdoZVnX8TP8olEyCUawrxEOtxe 8/RR4ZTE0dGliY+E23j9nyc+Fr5Jted4/uf43IrEn4ZHEueGcQc+kcof+FfJlybGh1WiYEWU dvcOdupw91fcrZstsu62w9XLrjjgah2uFouhc8TQudFI6x70ro3etde7qvExaL2ne3fuQASW rGundR3pCh2uUHCF16Pm2k7X6JxeCE95xxnesd39tnpXux3t887t3nX0gXflvKsz+hCPqnhX H08a4EkDvKiXF+3iRT3uvZsX9fCiHl7Rwyt6eEQPj9jFI3bxhl28ocIbKryhwhMGeMIATxjg Cbt4wAAPGOABPSzWw2IV1hqQ40vRsdbSbL8L9XVL3PffrWE51oe3a/+GdywPuCr0uX7B9Quu X0jf7/lDoc91ClHSu/Za+be84/WqZeWNJeElNu/06utezdbzrpp+2+SLUbT7cnjddV+Pxrrr NGffKJYK3vGUu09y90neuYcSuymx2xU2179sNs+6zyaKvO7YgVxoccVlPGhjfZk3pDAqXJVQ UxNqakJNTYwOkxPH4iNsfILnJ+Jk/dWZ7P4Zj88Nu6zms1bzWTFXoO5e6u4VcwUK701/NxqV /h50alSYlL7W40lhGiWmUWKauCtQeze1d1N7d3q6v9/ntZmY4/lc3O99D7jWQ47/SrknsCJM Tq91fAWvIost+CXy/tbpuB07wuTmKDzXPCy0NDegEcd4fhwuDXtZYJrYK7Dm7ubZLDIHc/Ej PBhaVOTVNU/cwdJ/Jevsl3X2yzr7Wf0vRPh+Eb5fhO8XzfujI9kjpn2Z9gXaF7yr+b25yd5j e4/tPbbvgn0X7Lu614K9Ft7NK/9BTrHW2DoL780RdSl3nMgDbmH9VtafzPqT63/OoiuxWrSu jQ6tfx4vyCEv89ONXq/mj5yquMX0/Uv8CluRx7ZwW32n4w68wf+6HX+NIkrRTbzl6fo3Pe5F 2TV2Ovah4r5vIfa4HwPhKjmpXcYuythF0Tu+mpvq93ntN3gnbKrf7xhEdR3qUc1bSd42zOOG 8CSPnJAYUYv6G0R9VyITZibeh/fjIIwK5/LWi3jrRbz1IjV1aeKIMD/xQX87EkdHX0sc4/hH GB3O58nn8+TrE8d5fjxOCGN59NjESR7/MU4OX5QbJ8gqr7LaElZbwmpLePsF8mRr4mznfBx/ En6S+ITjJ3FOWJj4lOOn8adhmqi4KPFnHp8bbhQZ35JPt8un1X+ZfU3iouioxMUYHzZUPyNP jw8b05fiu9FIUTJShEwWISN5yUReMpGXTEzf5O8343ZMxR24Kzo0fTemYbrzZ3ltNuZ4Phf3 u848zx9yfDjMTC/AI1gYlqYfDfNVsYXpJZ63YCn+NYwVVWNVtoU8cAkPXKIvWKq6LUw/E36S XoZnnbfcayvC+emfefxzrPT6Wu/jW+n1rvuS117GK157FVm0udZr2Ih25292bg5b/O2X+JXX tyLvuttCu8gdq3ouFL0Xid7z0294jQ+m+WC6AH6YLqEnvJ7mh2l+mC6DD6YreAuxffdj0OO3 w6b0Xgx5/A74XJrPyQoTmvldM79rToRNzUnHYV5rQCOaPB8ue6TAB5vT4fXmZoz0OIP3ef39 OAgHe31UKKrwRRW+2PwB1zvMOYfjCHwQR+JDzj3a3z+MY9zjj7wmw8pGE5pvCBtF+MTm26JD m9m6ma2b2br5TtyFu8OS5vvCfJG/RKYaK1ONlanGygJLZKuxzfNc50HXedg1H3H9hZ4/ikV4 LEyudRLfliV+Iiu8qJPolBF+LhP8SsRPFdk/ENktonapqF2t3u4SsT8Vsd2icrNoXCsKnxKF G0XdZ0XWJSLpERFzp4j5iYjZLkruFCUvi4KVvH/ege84Pcv7n639N+3vhw3RP8lXi6xkkYq1 vv5JNXpZeFneekTeesSqqtnz32XPNbLnGpVr8YEavloNLFltt+q1WvVaLX8ttvLn5amClWer Fcyqi/JNt3zTbeXb5Ou8lQ/K2Xk5O3+gwj0mFyyWCxZb5W6rvKL6LQ3Va336H/W4l4TVKthq FWy9Crb63R7hSs+vCo8c6BUWic9F4nORCrY+be5I34I7cVdYI6uvkdXX1HqH+/x9JuZ4Phf3 u8YDrvuQ44qwmN8v5ueL+XRBPcmrJ3l+W1BT8ny1cKB6LeaXi/nlYr5Y4GvdfK2br3XzrQLf KvCrbn7VXatux+okf1vhVvOpRSrcepVjDf9YzD8K/KM7mqhKrFMl1vGHVXzhUUpXVId1fOEL snm7bF7N4s9TNU/VjVTdyCeelrk7KdsmU7dTto2ybXwjrmXoQ8Mm2XiTbLyJj5zOR/bKsltk 2S0H+rU2mXWFzLpCZl3BZzbIpq/Joutlzk0y4joZcR3VK1SvULsiA66TAdfJgOtkwHUy4DrK VmS9dbLeOplunYy2XhbbIottkcXWy2IrZLEVMth6Gew1Gew12eo12WqL7LRFdtoiO22RnVbI TitkpxWy02uy0hZZaYustEJWWiEbbZGN1stGm1inTWZpl1naWamNhdpkl07ZpVMG6ZQt2mWL amZolxnaZYZ2ltrIUhtZaqOs0CkDtLPURpbaKPLbWapN5K8T8etE/DoRv07ErxPx60T8CtG+ QrRvEe1bRPsW0b5CtG8R7dUo3yjK20V5uyhvF+Xt5uCSzrjaU58ZhqKzRNkuEfUNETVLRM0S US+w80JRs4ddF7HrInZdJFqK7NrHri1s2sKmLSJilyjYxRYL2WKhCKh2ygt5/C5ePouXz+Ll s9hiIS/fxcurnfIsXj6LN++hVwudWnjzHlq10KqPVn28eg+9+njyHvosos8i+iyiTx9v3sOb 99BoEY0W0aeF9+7ivbN47h57XmSPa8KtPHa3HTzp2YC17w4P8c1cdISdVTzbYmeddtZpZwW7 ekkeKNrZS3b2ktVVp7OXrO4lq6tY3UtWVbGiihV1WlGnFXVaTcVqKlbTaTWdVvOSVVSsojM6 2p0GanPJoLvtwZAu8R19clTrXmJ3a3e3arUacLeqz7S724C7VavSAC0G3HWAFgPuPODOW9x5 iztvocWAuw+4+4C7b3H3Le7e7u4D7r7FjLAtPGDnG+x6gzvH7liQy34s426WcTfLaQ/KuC9H Dc4aPDA/xQe+sXRyYmw0OjpBlBdFedEZnc7o/t107cxOOxm0k6wor+qWtZOsXWRFQFEEFO0m aydZOxm0k0G7GBQBRRFQFAFFEVAUAcXfm3w/4JwPee13E/Boj48NWd5crE67vLnIm4u8ucib izXb/srK3q7Zdphn/bXPVPZiSCZpqH4bSVd1tq7qbL16zh7KYae/leX6nXLnTrmzW+7sljur uXGnvLhTHux2tW01v9lUu1KipmAcHecay/xlOev2ularM956Vxc9BE166dFLj173aD3wbyyv ZuVe+vTSpZeVe2nTy7q91tBqDcusYZk1LGPp3t/T5IOeH4nfaXKM84/1/DjHB53/cO0zk3JU Z/dx9AHr6z1Q57Za09Zq5FrTDqv/tXXtsK4d1rHDOnZYww737nXvXveu3ner+251363ut9X9 trrXDvep3mNrdKyrP2b3rXa+4j01oDrrt7pTXy3np2r/Uue+A562tdbZfl9+PJAb7XiFuz7m ro+562P/YV6s5sFjnFfNgcc5VvPZg879w3w23Gp+agXbap82NNS+F3upO29w5w0Hvie0Ljrd unPOXMNqWVNLwfrXU2kVlVqpVF37v/HoqlLPsHW1K+ij1jPUesZ+1rvqAldrZcWszrJaiZ+h 4DMsWfXyZ3h5kZcXWTRrf+t5e9Eec/aYs8ccq2Z1iAUdYkE3WK3QrZRupXQrry+ycpaVs1Rv pXqrva+n/DP2vt6+c6ycZYHW6INUb6N6mz2/aAcV+/6FVVeVb7PiPivus7o+ardRu80q+6yw j8ptVG6jchuV26jcRuU2Cre5Ux+F26jbRt026rZRt0187Q730mYjPXp4mIognk5Rs88Kb0cJ vdKrtU/XzgrbomM821371HK0HHcsTgv96ni/Ot7vjEE1vFdHVTnwKWOvOtyrDverw/0HPmXs rX3KuELe++0njf1qb7/a2/+eTxr71d1+XdGAuturMxpQB/vVwX61rz8artPYYyUP6Czi2ie4 Z4aSu1a/kfA4Cz5e+9S2SS8SJ0ZZ88m1zwffqH1ecZZ3fzn6S/nvqCjpGm/UrnFK2Ff93NVu 2c/5O5y7nQqj7OissKemx0qP+qJDPIr/4JPGvsRFOt+Lw3Y77rPjvvd8Mtj3n3wy2PfeCT76 sDtVPw3eSdduunb/wSfCJXfZSdOd7rDTHXa+55Pbne6yk6Y7adpN051/8OntTprufPfT27xz ujzfIRO+5xPZqM6ud0XHJpprFn9UDzeghxvQww1Y07PW9Cyl9ujjKvq4irP7a5/1fcbfz619 y28Z5ZfJwx+Wh6v/nrqoF6voxSrW9ayeq6Lnqui5Knquih6roseqWM+z+quK3mrAmp7V51T0 ORV9TkWPU4kareZpd95V+4SxasFz3fnLYbW7rY5G++t2um2zxq3WuNWZ1U/U36RfD/166NdD vy767al+TkXDbTTcQ8M9NOyhYQ8Nt9FwDw23WetWGm6jYQ8Ne2jYQ8NtNNxGwx4a9ljzVhru sd6tNOyhYQ8Ne6JDqdZJtU6qdVIqT6m8dW+17hylOimSp0ieGnlq5KmRp0aeGnlq5CmRp0Qn FfJUyFMhT4V8dIR9luyxZI+lmhqnuPJpKvLpOAN/Il6ekqf+Dc94vAwrQkm/228vWXvJ2ktW f9tvH1n7yNpHyR5K9pC1h6w9ZGvf4az+a+PDo7nROJngEnwLPwiPR9eEe6JrcR0m4Xq8ER6N uvFr9Dtnb5geDWEffoN3wvS6E0J73Yk4CR/FH+NkfAyn4FSchtNxBs7EWTgbH8ef4BP4JM7B p/Bp/Ck+gz/Dufhz/AX+B/4Sf4Ux+Gt8Fn+D8/A5nI/P4wsYHx1V94vwYt3qsLbuOazBWjyP F7AeL+IlvBzWJh8O9yTnYwFe9TyLDbDX5H6EMH3Y+8KiYQeFR4eNCu3DDsGh+AAOw+HoCvcM KztnJ94K9zSciLNxWVjU8C+4HFdgYni84UrQvWF6aG9oC2sbBkN743FhbePxOAEn4nScgU/h ovBo41dxcZjeOAcL0eX5duwAmzX2hMcb30TF33Z5PhimN9WH9qYE1PemYWiA/rVJ/9qkfjep 300jkEYzRiIDNb1JTW9S05sOxifC2qZP4usef8vxRsfHHB/H7tA+3LWGHxzWRl+LDuJxB2MU DsGh+ACOxwk4ESfhozgPn8P5+Dy+gAtwIb6IL+Er+HuMC0t57lKeu5Tn3hFNMCNMxJX4Ia7C NeEJ3vwEb36CNz/Bm59I3hGyyTtxF0RFchqm4x7MwL24DzMhYpKz8bD3zceC8ASrLx22OWSH ia5heXSiy+sFxyLK/r4Tb3ntnZBtaIC+umE4UjgMh+MjOA50aKAD73ii4UzHsx3PcRyDr+Fi fB3fwGVhKc9ZynOW8pylPOcOnnNHg/022C8PeqLpiqo20Qw91b24DzMxC7Oh34qq/dbjWIwl eAkv4xW8iiw2oA2vYSPasQmvI4c3wjI5YZmcsExOaI/MPNEusH3EdyOzjzyxSp5YJU+skidW yROrkqXQnuzBm+hFGWamZB/0oUl9aFJ/mXTNpGsmXTNZfd9+hLBKvC1rlAsaxX6jWG8U643i vFGcN/4tvoyLnPNVXBxWNX7H8wmYiB/iKlyHW3EbxFsjjRpp1EijRhqJp1WNP3Zc6Pik4wrQ oZEOjXRopINYWybWlom1ZWJtmVhrF2vtjfbUaE9ibpWYW9ZID3G3qu5jUVI3MgwNaEQThiOF EUijGdXfnP5kdHJ0DsaFeXx8Hh+fx8fn8fH5fHw+H5/Px+fz8fnR1dFB/HwKP5/Cz6fw8yn8 fMp/4bekTo9a8UaYzaKzWXQ2i7aw6EoWXcmiK1l0JYuujN6O3s+q01h1GqtOY9VprDrtv+t7 8fWnRofXnxadXH+m42fw12Fe/WfD7PrzcGF0WP34sKT+0nBz/XdwWbhZz3Z54qvhdn3b5Ymv O04wyUxUp9uiTOK1aFSiHa+rsh3RUYk3wqpEt+e/jk5IFGq/6jA68aZjb5RJToiOSk7Elfgh rsLVuAbX4jpMwvW4ofY7WlPkiynyxZT/6u9o8fZpvH0ab58m18yrfSf/oDBbjpkyrDc6SH6Z J7/Mk1+mDNsXHdWQAN9qOAgHYzRODFMaTnI8DWdEJ8spUxo+7vFlYZ78MU/+mCd/zJM/5skf 8+SP+fLH/Aa+1HAN+NK73/VvDzv+t+/tV7+L//mwUqTNFmmzRdq0d3+H63e/wVX97a05Xv/t 72+dLpqm1X6Dq8v527EDfE7ktIicFpGzUuSsbNwZvb+xDxXn7/J3/ieCplV/p+v/2Xf03/tb X+/5rn31e/SpsWF2yr5Sk8LNqRsgblLiJiVuUuImJW5S4iZ1N6ZhOu6B/abuxX2YiVmYjTmY i/vxI8zDA3gQD4E+qflYgB/jESyMDh9xbXTYiOswCdfjBtyIm3AzJmMKbsGtuA23YyruwJ24 C3djGqbjHtyL+zATszAbczAX90eHpT8aHT5yeHTYyBRGRIfpFjeIgjdqv2KyofbLJ0fV/1A2 y8hmGdksI5tlav/HhOGo/r+tRiCNZozEQbrbgzEKh+BQfADHQwetA8jrAPI6gLzMN1rmG60T KOoEijqBok6gqBMo6gSKOoGiTqCoEyjqBIo6gaIsOUGWnCBLToi+bdIaj0vxHVyGf8HluKL6 b9XxPXwfPwhX/4cZ9ZowRjYdI5uOkU3HyKZjZNOUbJqSTVOyaUo2TcmmKdk0JZumZNOUbJpS dwvqbkHdLai7BXW3oO4W1N2CultQdwvqbkHdLci8o2Xe0epvrP7G6m+s/sbqb6z+xupvrP7G 6m+s/sbqb6z+xupvLFvPkK1nyNYzomIoRyX04E30ooyd6EMFbyFGf3haZl8usy+X2ZfL7Mtl 9uWy+mRZfbKsPllWnyyrT9bT5/T0OT19Tk+f09Pn9PQ5PX1OT5/T0+f09Dk9fU5Pn9PT5/T0 OT19Tk+f09Pn9PQ5PX1OT5/T0+f09Dk9fU5Pn9PT5/T0OT19Tk+f09Pn9PQ5PX1OT5/T0+f0 9Dk9fU5Pn9PT5/T0OT19Tk+fq7sgOrzuQnwRX8Lf4kchqxJlVaKsSpRVibIqUVYlyqpEWZUo qxJlVaKsSpRVibIqUVYlyqpEWZUoqxJlVaKsSpRVibIqUVYlyqpEWZUoqxJlzRKtZolVZolV ZolVZolVZolVZolWs0SrWaLVLNFqlmiteyVK1b2KLDZEKVUso4qNVMUy9eYdlSxTb6ZRzZar ZuNUs3G1avbVUK4fh/FhznurWv2/1H7dZYzKdqnKNkZlq/5K0pOJH4THEitUsZVRc2J1uC2x ITylymVUuZQqV1TlUonNYYdK13Lgt4uOqv3O5Zte742GqXIZVS6jymVUuYwql1HlMqpcRpXL qHIZVS6jymVUuYxOuqiTLuqkizrpok66qJMu6qSLOumiTrqoky7qpIs66aJOupicE+LkXNyP H2EeHsCDeAgPhzEq5xiVc4y5q9Xc1WrualVFU6poShVNqaIpVTSliqZU0ZQqmlJFU6poShVN qaIpfWasz4z1mbE+M9ZnxvrMWJ8Z6zNjfWasz4z1mbE+M9ZnxsndoZwcxB68jb0Ywj78BmJC ZZ6sMk9WmSeozFmVeYb5L2f+y5n/cua/nPkvZ/7LmRLypoS8KaFoSsir4GOGdYfYpJA3KeRV 8gkq+YRh1jTMmlT0MSp6xtSQH7bf8xDihgh1qEciyqj0GRNF3kSRN1HkTRR5lT+j8mdMFnmT Rb7hSOd+CKO99hHPj4Nca8rI6wzG6AwyDaf6+2mOZ0SjTR15HcIYHULG5JE3eeRNHnmTR97k kTd55HUOE3QOE3QOE3QOExrk0QZ5tEEebfgBJmBiuFo3cfW73YQcap7N6SSyOolsw0NRquHJ 6PCGp/CMxz91fN6xLbTqMrINbGnuzTVUf5HzQyGr48jqOLI6jqxZuNUs3GoWXmUWXqUDyZqH V5mHWxvPiVJm4lZzQWwuiM0FsbkgNhcUdCnLzQWxuSDWrczQrcxo/IdQbvwaLg6TzQdx42Ue i6nGy3EFvovvueb3YV9mh4LZITY7xGaHWIeT0uGkzBCxGSJuvMP5d9Z+2TDW9aTME7F5IjZP xOaJWBc0WReU0gWNNlfEOqHJOqGU2SI2W8Rmi9hsEZstYrNFrEOaoUOaoUOaoUOa0djt2r9G AXJ9o1yva3pa1/S0rmm5rmm5bmmybmmGbmm5bmmybill1s+Z9XNm/ZxZP2fWz5n1c2b9nFk/ Z9bPmfVzZv2cWT9n1s+Z9XNm/ZxZP2fWz5n1c7qurK4rq+vK6rqyuq6sriur68rqurK6rqyu K6vryuq6srqurK4rq+vK6rqyuq6srivbdLo1nYFPhNamT+Lrrv1Nz8fhEnzLa//s+G2Mx6W4 IhR1aFkdWlaHlm260Xume/0x5z4eVjUt9ngJdofc8Cg6XAeXHW5vww8OrcMPiVKpL4X2lLkw 9RWMDeN0duNS/+DxVaGcuhrX4ned3k0e34LbooyOL6Pjy+j4Mjq+jI4vo+PL6PgyOr6Mji+j 48vo+DI6voyOL6Pjy+j4Mjq+jI4vo+PL6PgyOr6Mji+j48vo+DI6voyOL6Pjy+j4Mjq+jI4v 8/+x48v8Xsd3SDQt/FXdxdFFdd/AP0ZX1f1T9I9134wuqBsXjav/6+jP68dHn0p8OXwlMTZc mGgNrYmVYVxiR2jXG45KdNd+43VBohSyiR6z1Jvmrd4wGB0dTdtfilpCd7Q2dLv6pw/8Iu0F rn6uq5974JdkB6u/Fe0uh7tLyl0+7S5j3OWexM/CS4mfY2VIJX7huDq8kXjO1deEh919gTvv S/y6dvcvuPsD7p5y92Xu3h41JbLOaLMmk3xio7W3hxcTm7zWoSJudkba2l62tped+Q21M+vs Bc6+3dmHOLvF2V9RR1d5x/XeMTk6pvr7klY7XzX/Y9V7fP35Kvn4cFf95dV/2xkdU78mTKx/ ISyo3xadU7/bPDpK/3xKeDbxM9V3ZXSqHax3p1bzaCqxsTaLZlXpjKvvs6Mulfr2A5U6dWAm TdlZnOixq9ovDYZK3d9FybAoGoYGNKIJw5GqfjsbaTRjJDIm+/fhkyEbnYPJYWo0BbfgVtyG 2zEVd+BO3IVp4RfR8vBM1BqeqavX/ySQxDA0oBFNGI4URqAZ74M6WXcQDoZcUieX1MkldXJJ nVxSJ5fUyR11cked3FEnd9TJHXVyR53cUSd31B2H43FBaK+7EF+E2K4T23WTcD1uwI24CTdj MqbgFtyK23A77gkv1s3AvbgPMzELszEnvFh/aphafyY+gwtZb2rI1t/BMivDF1mlzM8G+dhT LFH+7W8+ej64/7nEnjAq8fb+fGLv/vbE0P4liX37c4nf7F+eeCeMSOz3ethfTg7b/1yyIYxK Nu7PJ5v2tyeH71+STO3PJUfsX55MhxHJZq+PdN6EsCg5EVfih7gKV+MaXIvrMAnX4wbobZN6 26TeNqm3Teptk3rbpN42qbdN6m2Tetuk3japt03qbZN626TeNqm3Teptk3rbpN42uQz/HtqT y9GKFfgZfo6VWIVfYDWewxqsxcYwNdmOTXgdHdiMHLbgl/gVtiIfpg7bFxY1JMB/G4aFloaD HA/GaJyE03CGvuDjjneF9obZmOu5fTY86rH9NNhPg/002E/Dk157Ck/jJ/gplnu9FSvwM1h7 g7U3vOTxy3jF41eRxQZ0YHN4seGX/lZEL2L0YwC7sBt7QnvjSGTwPrwfh4UXGw/HEfggjsSZ +pSP43thauP3cSNuwgw8jAXhmcYWxz1hatPxob3po2rcxxxPdfw8vuDx34cXm77p7+NwCfhj 01yv348fYR5asC+8ODwK7cPf7yi+hour4Wr0cPU59U1cistwOb6LCRDvKfGeEu8p8Z4S7ynx nrob0zAd98B6U/fiPszELMzGHMzF/fgR5uEBPIiHYI+p+ViAH+MRLAxTR/xNyI44D5/D+bDX EV/ABbgQ14YFI67DJFyPG3AjbsLNmIwpuAW34jbcjqm4A3fiLtyNaZiOe3Av7sNMzMJszMFc 3B8WpD8apo4cHhaMTGFEWBAlZf+nZP5i4nW1bLM6Niu6Rv68FtdhEq7HXrl0CPvwG7wjV50Q YvNzbH6Ozc+x+Tk2P8fm59j8HJufY/NzbH6Ozc+x+Tk2P8fm59j8HJufY/NzbH6Ozc+x+Tk2 P8fm59j8HJufY/NzbH6Ozc+x+Tk2P8fm59j8HJufY/NzbH6Ozc+x+Tk2P8fm59j8HFd/D6xu XcibWctm1rKZtWxmLZtZy+bQR82hj5o78+bOvLkzX78w7FDRFqlkpfrBsLN+T9hZ+2bTanPn BtWoLeRVsEVmuBYzXIsZrsUMVzbDlc1w1fkpa37Kmp+yZqbYzBSbmWIzU2xmis1MsRmpxRzU Yk5pMZO0mCFazBCxGaH6C6KxOaBsDig3nhTyjR+t/Rpo9ZdAq718Vp+d1Vtn9cJZPXBW/xvr f2P9b6z/jfW/sf431v/G+t9Y/xvrf2P9b6z/jfW/sf431v/G+t9Y/xvrf2P9alm/WtavxnrU 6i905vWhsR60rO+M9ZuxfrM8fFTI6zEf1WM+qqfM6ynz6UlhR/p63BB2NI8KO5sPwaE4Gh/G TV5/pPavm7rDInVdj5lojc5IrIi+mVgVHZv4RXQEfV9JPBcdklgTHZ/IRufR+rzaXL8xOtds n0lsik6ne7n6KbY+Z4dX34hO1i+cV/sMu/p9hh5dy28/yz7dnVaH5c5fXrvnU/52fZRwvxO8 1l49MxpRd0GUqrsQX8SX8LcYH51uekuZ3qqTW8qUlvqf1H0JeBVF1vapqu6qzr3dNwECISxh 31RUIsoI4i4z4zKO4zIOKKKCuODgsAkIoo4IKMqiAioqCuooio6KKAjohyK4sMoiEpYECMGw BEhYAqnvrbpNCEuABOT//r5PdVdXnzp1uurUW3Wqu89NMP+66kCeNPSOi6xPZIyHkCGekobR MhupjTFaTsRoudjOB2GNo+QszIRy6DK7pmho0yGD+T+EDZA47j/ZepU2cyLz3MT6n7tVLxQ9 UDdfQ4daUyLy3qoX4WwlqKdjLviVzsdZJs66IN9Xeg/OFlEjcsDdRZAICsFDSECIIEQRfIQA IYYSb6YKoq3+TrRH6IJanKaXgtNqcFrg9KB0pydCL4SHEXoj9EHoi/AIQj+E/giPIgygdNjy 6bDZ02Gzp8NGT4eNng6bPB32dzps73TY25DFyjoVc7ppqKvpeq2YiV70lf4FJU7D7HYL7r0H nQmdqICreUYXcO/JVJEtoJpsITUI30vrJNqCKu6p+UzjqVl0sd90/SB6YX47ipqI0QhTdQ5a ui5mMh87F9IZTktqgNpqRzHkiKGcc9CaPdAC0/UWlPSDLSlACb+hhHniNpR/O2agHXC8E8ce KGWBXok5ci7mx/us/iwlF7kiJM2/sYA6FZSpoEwFZR4o8qkKZQFFMYei9XHvfbbEXjgCJ9Dq LhB3OfjtBOrmI0ee4WlmxG5FXQAbvgA2fAFs5ALYyAWwkQtgIxfA9i1AmTfjXm8Flx5ouXnI ZbiZFdOUQ8q8Dfw7IDxIzJY9HzW/AOkLUd4i1PNiaM4SzMyXUvSEyo2G5WaCWyLuohAcM8Ex FxzzwFGGq2+uHT9ioM4Tt1o5MiBHhuhm27geJFbCeG6Oy1KAnFHIUojcxkLJo7Mpi1rQOoT1 CHuoIe1FKETYh7CfGoJzB2st3YZ+djvdLDrgeCeOD8KS6QbOvfQs0Q8tOQqaPho9FrMe1FF9 2zaL9Me2tJ/1MvS5ZFg5+6Aj6dCRdAe8nSIETQ3ditRCtUVoh9CeGqrRCBMQ1uB8LUImAuRU W5G2E8cCyJYAyQogUVNI0xT3mhy2DkZX9ADTxsugM0bTZkL+maiZbFAno3aykSMZOdJBnQA5 N6NmdkDWPMi629SrzTXP6ifaCLpcD323APpcT/QEEmZSSny+Dn3NRuuY77Ry9Cz7Tz6mzTJA FUFKPuQ44CEufDtGdIeOPIz+vxH6kIP6l6FP+2zkAbbhDjYg5OgMSqWOkKQTwj0I3e0/GBRA nnmQZR6oky11Fkq0Vhyu5QAR7borxsXWlOYm6Ww3F2GzzpZdEB5E+CdCV4SeCL3ANxb+L4Lx xJkBzhmiO+6oJ+40E+2WpTfhTvfE71TvgtSFKGWutb1TIF8e5MuDfHnFvaQtOLVH6A7ZeqJd MpEzC7IbOzpubZq7W2P+Awny5UG+PMiXB/nyIF8e5MuT5plKU4LlTp0Q7kHoi/NHEPoh9Ed4 FJzj/5rUBBgVC/3QG8S5DBg1GrU8GbX8DfRyKvTyIuhlG/Ee9DUTkmXh3qw0GKey0WYbdQZ0 sgV0soXTWi93XqemzjiEN6ipm0Rt3DU45uK4GWEbNZVNzLNPhC7URj6I8E+ErghGPi9sI6Mz bqgzrm2rDVYj8uzqw0TI/XZIlRpSpULuPFCmW9lM+0vRpegdsVtvha2X4Si9FbZchtO4aA5k 7lK0BqkFSClwGuuzwLVL0TJRgJYqRO594LRfZzqu3uNEdKGD+QgoM0HZzOadhKvLkbIc3PJt 3nliL3DC5N0PbdDIk0DK5vVhg8VwbKzTqCIo56CUQlileZAsV5i3wgtR6j69FzkXImcBSi2E NZoHiXMdzIrAZQ8k2AtOC8EJ8hatRUt1gR0b55IPLoXgUmRktmXHc+cjdyFyF1nZ4zK4VAU5 u0CGTLELdbYbxz2oP8ySwztfLvajTxfp9eC0B7JkOpJSwS0T3AqcBIzy8RrB/VOCE+j14LwH Mj1rRs2iTHA0dZAtijDmKHv/2U6AeGNNluJD2yJ7LVW8VRIslWmZRajdw9oL84mwnZD7OO1j aW27gPY47UFJJ9sO5Je1/qHFp7jeoeOl1Le9ctR6ppiTTJ5TGVyrUsSphlAdeWogf03EMVt1 auFaXcTrIzTAtYa41sjMKp0q4FEdV2vj2MDUgZOMM9gMTgpoqtmreZZXGtJrIV4H8fqWOs/w IWmpq9pS8y1FXVtKPlWEXC6u5jpVkJKCUJXSIF8iKHPBMw3ygS9CLZzXxvU6CHWRXh80DZDW EPFGKCMGLtmQ1dyh66Si9GokQi4mdzbkN3foOvVwrT6uxXO7lAQZIsi92d5pVfCtBqrqqL0a SI+XHwGHzbYG6uJ6faQ1wPWGSDdl4y7AvzKuVtHbnBRzr9A4KwPasgbKrYm0NNDUQlpt0NQx dQAaKwtoGoKmEZDOtFOirdeqlBy2UyHkSIYcMciRaOu2Ls7j7VQIGZIhQ8y0iq09N8y18xDp zX3Hc+wsljqxvDqBXvszYofpBXp7LQrKqhvIVQ+9tBT9wFVOlU6VjoBbZaSUU0+Q26cKJ6sr 4FLF3NGp0Re0xATbjuXSGXtHQVn1BmXuxmy2oGghsLApEMcBqjUTe4tmANWqi31Fs4A+F4qi okKgWpLjFi0ENjYFGjlAtWZOQtEMoFp1J1o0C8h0oRMUFQLV0AeLfkGNVEONBKiRwKlaNAc1 UtmpVrQBUtVHrTioFe6kga4W6GqDpg5CXdDVA1190DUAXUPQNYLWJMBSS4SN1UaYfxGaZWf1 yZjlpmFWkW7W7THbS7X/ZDSVtadWrAO1YXfSM+wuHO9GLvO/Q7fob8XfMRu6VY+1/47X5BhU 31qqA/+4NLb47KPiM84CWMBNiaglXUJnwOa+jM6la+hGaka30N+R+g/M2y6ie2koXU3P0XvU labSDJx9hd8I+p6W0khaDpvjdcpmifQBq86q01KWxprSMnYtuw6p17ObKIe1ZbfRVnYHu4O2 sztZR9rBurB/0i7Wk42hvexl/NLYWPxqsdfwq83eZe+xOuwrNp/V4+fydHYeb85bsAt4S96S teQX80tYK34Fv5K15m14G3YJ/xO/hl3Kr+PXsSv5DfxGdhW/hd/K/sTb8XbsGn4Hv4Ndyzvy Tuw63pl3Ztfz+/g/2V95N96L3cJ780GsHR/Cn2UP8GF8FHuIj+Evsd58Av8v68s/4d+ywfw7 vpS9wpfzLDaRb+S/sSl8K9/GpvHtfBebzvfwQjaLa0FstuBCsDlCiYB9LxJFRbZQJItktkRU EdXYUlFH1GW/ivqiAcsQjUQTtlqcJZqyTHGOOIetE81EOlsvmosLWLZoKVqxTaK1uJjlikvF pWyLuFxczraKK8WVbJu4TlzP8sRN4la2U7QVd7M9oot4EEV3Ew9zV/QT/XhUPCoe5b4YJUbz QEwSk3ii+FR8ypPEFDGFVxBfiFm8opgnlvGaIlP8xhuJAqF5M8d1YryVk+w05lc5rZ3WvK3T wxnE2zlPO5N5V+dzZwZ/xfnJmc/fdBY56/lbzkZH8y/ciBvhC13f9fkiN8mtyBe7i91f+FJ3 pbuGZ7hZbhbPdDe4G3iWu9HN4evc39xtfIO73d3Oc918dxff7O5x9/BtbqFbyPPc/dLl26WS MV4ok2SSELKirCwcWVWmCU/WkeeJRHm+PF/UlS3kH0U9eb28WTSXt8snRCv5pHxK3CmHyGdE RzlMDhOd5Qg5UtwrX5QvivvlaDlWPCDHyXHiX3K8HC+6ybfkW6K7nCg/ET3kZ/JL0V/OlP8j npSz5WwxWM6VC8QQuVguESPkMrlcvCBXyBVilFwlV4vRMltuEi/JPLlPvKpIcfGuUqq2eF81 VM3FbNVStRZL1KXqUvGLukL9UaxQV6u/iNXqBnWDWKduUjeJ9eoW9XexQbVVd4iN6m7VUWxR 96n7xDb1gOot8lRf9ajQ6jH1uOOop9QzjlTD1BjHVy+rl50qaqwa66So19TrTlU1Xk1wqqmJ appTQ81Sc52maqHa7jRXOwFyt3gNvYbOXV5j7wznbu9s7xznHq+519y517vQa+nc513ktXYe 8P7kXe086F3rXes85P3Fu975l3ejd7PT3fuH9w+nl3e319l52Ovq/cvp5/X1+joDvP5ef+cx 7zHvCedxb5A3xHnSe8Yb6gzyhnnDnCHeSG+k87Q3ynvFecZ7x/uPM8Kb6E10nvcmeZOcF7zt 3g7nRS/fy3dGe7u93c6YBICZ81KCk+A4rySoBOWMTcDmvJqQmJDkvJZQKaGyMy4hNSHVGZ9Q PaGGMyEhLSHNeTtyY6St806kQ6SD82GkY6Sj81Hk3sh9zn8jD0QecD6JPBj5p/Np5KHIQ85n kV6RXs6USN9IX+fzSL/IAOeLyKDI+870yFeROU5WZElkpZMbWRVZ7+yM7IlWc/ZF60WHu2nR kdE33KHRz6Iz3LHR+dHt7lu+8qu6c/0z/avcX/1b/XvdAv8B/yGp/G5+Dxn4vfzeMsnv6/eV lfx+/kCZ7A/2n5Np/nB/uGzgj/RfkA39Uf442cR/039TNvcn+O/L8/0P/U/lxf4Uf5q80p/u T5d/9mf6M+XV/tf+HHmN/6O/SN7o/+z/LNv6S/3lsp2/wl8t2/tr/W2yo7/D3y17+Hv9fbKv XxSQ7B/wgMvHAieQ8vEgIQjkk0FSUEUOCaoGVeXwoFpQQ44I0oL68oWgYdBQvhIMCAbIscHj wUD5ajA4eFa+GYwInpf/CV4MRsmJwUvBS/KD4JXgFTkpeDV4Q34YjA/ekZ/GeCwmv4hVjKXI 2bHqsZryx9iu2F45n3jCExhRKDo16UtqRLXolGx6lV5NTWFZkV541OuF+jk9Cb8C3Rtnd+hO +n09GbFMezVTZ2O/NqQtOCK3uZqt8/A7eC35CKqtCE8eV9LBCP8tcb4c3CubEkrdInqvkU7v QNy8I/tHaojzjGIOG4tjmUcpb6FeqXP0D/hl6m2YrZ/slgKe4yznLJ2r5x4oXeceUXKurbVc nYHav5Oqo8aaGMnDq4XHK0jn6y16u96o1xcnVULqFnvtU7Reov4MsXVHzQsqvRmlF+gcMrWW RvXo0rj0uLJUL4W2rDaxUsp+TY81d6l7IvxFX64f14MQW118/beSd3lY3kLU9SqU/bX+Fnef h5Zywyu/HEY5+7h1sJNCTdPD7T5PbwX3UAtL1MwB+nzU2Ha9Wy8B3dX2bluh5kMp9Sa9Cfuc kHb3Ebm3os42GB0J+0UBVbPHxaXfbSlyZxxy9kCJ+JcnxgHb2QdLRIstJlcvOU6ppgduCk/O oObHpH1bv2z0xOhQ2Te93twhtGvlEVfWHjfvNoR/29j7h7egQafj5M5CmGoRacXBnn+iG7Q6 3+4XH+Vi4glx2I6wpqzlhnm/Co+Ty5H3Vbufbe7/FG8tj1v2xni76j3A0i1l5H7sWm2BcLMt Y218H/+FV482OjbBrxZ+TQ6R8G27nx//HSN3s6Pm3mD3m/VOYNfO0kTFNYNqm/Svph+aPHEM j495QLtv9Pf6u1JzlxhV9RCqA0S+jq5H/F2bshjj1Jd6eam5S4xbeiTGgVS6CpYnepBN+RV9 4ZuD6Fxa2WYEhR6Z3M1htYbp+gs9BWNsqbh0EOvDLRH11xbpfezV6fpz/ZWeEdJuPiJ3iZEd NZVoxyEzqlxrU75B6VP11FLLLmVeUGRmBD/of+gb9AP65pD2CCTTQ1Cvc/RPevUhOMOpPf0b FjrBXh9mvjqh98mnSTSFGtM02O7p1na/gGbBdm9Bv8B2vwZWOqNbWQfWgbrDev4b9TB2M/Uy FjM9zO/nD1If2L7LqT//la+iR3kmz6InYAdvpCf5Jv4bDTTWMA3iBXwXDeGFvJCeMdYwDTXW MD0HazhKw4XxSfSiuE3cTqNEB3EnjXE+cz6jl2FHanrFrehWpLlyspxM38vpcgb9IH+VK+kn qaWm+cZ+ogXGfqIl6q/qBlph7CdaaewnyjD2E6029hOtN/YTZRv7iTYa+4kKjP1EhcZ+ov2w n0YwoZ5XY5g0VhTzjRXFAmNFsZixoliSsaJYRWNFsXrGimJnGCuKXesJz2W3ep4XYe0834ux 9l4FrxK706vspbCOXjWvBuvspXm12f1ePa8Be9C72LuEPQTLqRPrBgtpMOsJC+kZ9rCxgVhv Y4uwPsYWYX2jj0SHs0eNhcFe8JP8quxz/33/ffa1n+VvY/9j5vhsgZnjs6Vmjs9+MXN8ttLM 8VmGmeOzNWaOz9abOT7LNXN8ttnM8dk2M8dnu8z8ne0283e2x8zfWVEsIRblIlY5lsJlbHds L0+A3iyxesOs3nDozSjM5EfTy5jfvEITkPIWforepvfIo4nQKmm1SkKrvqQEmg7diljdikC3 5iL9e/qZouC6BHmX4hdA21ZSjDIoE30sC5pXm7IpD71mO351aAftorq0G796tIf2U30qgl5W sHpZw+qlsHrpW730oZddKIk/CO30rXZWhHZmUBW+CjpaCTqaSSk8C5pa3WpqNaupKVZTK1tN TbWaWolrrqmSIOhrMvSVY4+NKkNrFeJodqoqEqDByVaDq0GDb6MG4nbocUPocQfE74Q2N7Ta XAPanEHMWeWsJ+5scLJJOhudLRR1tjo7qaaT7xRQorPL2Udpzn7ofX2r97Wt3tewel/D6n0N q/c1oPdXULK6Ul1JUXWVuooc1QY9wUVPuBop16hrkHKtupaUuk5dR576C3pIXfSQvyLvDegn CbafRNFPbqFA/R29JYbe0o5qq9vU7ZSo2qv2VF/dgf5TwfafCrb/MPSfB5Cri3oINP9S3ZDS XXUnrnqoniill+oFzg+jj0XRxx5Brn6qH9L7q/6gfxS9LrC9jqHXDQLNYDUE5T6NHpiIHjgM KcPVcOQaoUaA5nk1Cimj1WhIMkaNQQp6JkVMzyTTM19DrtfV60gfr8aDzwQ1AZQT1USkvK8m Ie+H6kPUw0fqU9TMZPUF5JyqpqJOpqlpkGqW+hbSzlZzwXOhgk6qJQraqJapFeD2q1pNtdQa lYU6Wac2oqwctYnqqN9ULmpys9pC9dRWtRUlblPbIfNOtROU+SofVwtUAdJ3qV2QZLfaA/57 1V5wLlSF4LxP7aNKar/aj9KLVBHyaqUpanCEahgcwR44gj1wBHvgCPbAEeyBI9gDR7AHjmAP HCEGHBmE/WBvMHGDJuQYNCFm0IR8oEk/7PtHBlCSwRQSwJSl5EeXRZdTEP0lup2SDL6QMPhC VYEvWVTJX+evo2R/vb+eAn+Dv4Gq+Nl+Nq5u9DdSip/j51B1f5O/GfEt/hbQb/W3gmabvw00 O/wdiO/08ynVL/ALQLPL3w2avf5eXC3091HUL/I1pQTo/lTJIBf2TuBg7waSKgK/IlQ5iAZR 0PhBQNWBZZWQkhxUoVSDaFQFiFYN++pBDdCkBbUoOagd1AaHOkFdxOsF9UBfP6iPOPAO6cA7 pLwavAb+rwfjkOuN4A1wHh9MAM+3gneoskFAsghISQYBKQko9UGIgMPxE8UIOAbxV4B9wmKf C+R7H/FJ9Dn2X9BUi4BfIf4/wD1B3wL7BLBvCbByKS1DfDl+ymKfsNiXbLGvssW+BIt9VSz2 pVjsq2qxL9ViX5QlskTyWVvWFvsuDEjHurJu2PdgPbB/mj0N7LuB30DcIqMHZOyIvUHGiEVG zyJjYNGwEs/l5n8jDAJWsAhYke/n+ylmsS9ROMKhCkA9D/GIiFCSaCvaUnXRTrSjmhb1aljU SxPtRXuk3yHuQLpBwBoWAdPEXeJuqlaMgNkkgH07SQH19lGCxbtUi3eVzaoo+ufl6nISFtcU EO0a7A2WCYtlrsWyFHW9uh4pBsuEulHdiP1N6mZQGhSrbFEswaJYKlCsA/r2Xeou7O9Wd4Oy k+qEfWfVGXuDaMoiWkKIaD1UD6T0BKK5FsuU6qP6WETrC3qDaAqINgDxOJY9of6NuEE0ZRFN WERLUEPVUOR6Vj2HFINuyqJbNES3kWokCYtxymJcqkU3oV4FrokQ18apcYi/od4gqd5Ub4LS IJ2wSJdaAumERToFpJuKuEE3pb5UXyM+Sy3A3qCbArqtQNzgWrLFtcoW1xIsrlWxuJZica2q xbVUi2tRtUPtQC6DbpUtuqVYdEsN0W0fUExYFIt6zGMk4ngU6R3pQ17kkcgj2PeP9KdIZADQ JxJ5PPI4UgZGBpJnkYhHR0ZfIm4xpZK/GWiS6Of5wFOLIIkWOyoBO3YhvtvfQzGgRhF6skGN pEAEgmLAC0WBxYsKFi8qASkqIm6QomKQEqSAxmBEpaBmUBPptYARFYERdcDBYEQFixGJFiOS LEZUAEa8Cp6vB68j1/hgPOgnAB0qWHTgxJvealYzm+296ElYJDeVNo//v7zp7TrTBBvPO3Tl ppimQK8/5hplabzNiuwqhLn2bNWBNGO92NXBQrNCFl8vghR5h65glm4PhtcXhcd7yi7Zqdp0 Oz3WHrefEHWmnmesvRNdRyuVT+6hcbPOWrxWth1WX6bOMLWplxVTHWy9cOXa1rnxBpBGiYba ph2x9v27bpFQkpKlJtLFNm3N4a2vtxy53gXt+UnP1bvKo5vH3/SC8JgVavK2Etd2HJDeSnGU 9tQrj96XTolkZeasx+nR9ligF0Az5iNM0i/oRWG7F8tvVxYXQIfmlKu/51KJpxDx5yYlrg7V 24AjuWGNbjSSlMh8QBvyT6Cc3XTUpx0nu6ElD0q/E3W1BcGsGu06hGrTkTn/r23Fa145J6Yr J4tIx+R9tNXm0qln68n6G/2RwSnE4yubi8M1ypxiqg0Hsa0MvH8165ch9m2yT4DygCDmqcik OH+cz8LxOxMQP2Q9U08kg0/pB+4KqLsYKHUJ1dHL4k8CdJaeZ4/PHVjhO7mt5NOt+NMj/UHx +av6fj1Ed9AzEb+tOPVy3UV/YUeaw2r9aCiFO5iqZ0LHS107Lafc2y3ShNIbSWyNlxy18kqu jOsVx+Q259RKV5YNaBQ+f9M9DrvyjR5YHC8ewaARBi/WYWQ95j2VUppBTNMWtm6sfm4K6wl7 3dOWo+zz4MNH6mT7llZJXmYGsApjVsRwCucGe8Jrecer8xOQ9SBSlngKdgAb4/MRYHy2LesQ zbP9LfuI8T23vM+VyrvFZ6Ulzkud/ZR8glkiddqplacE55vLQGyf8+jB4TPFAvToDeYJof5I T4w/KTxkfM8Ltewz/XE55PoS84IpYXwOMNo+zzX90+gA5hiZ4TOVAousy8PZRRxFg8N4zbTY M9ni/Mz4MxD9/SEU+8suYZhzEZV42h4i5yKLQTNtHFhocfPruBbEn0jGe0d45Sp9pT2bru9B Td6P8IR+FsdPbOo3h5T2CWq9h/5bOeTsqsca7Mb9r0WsHWKPw0IYq9/DGDhc36BHGosBqcZm +FCPj/cZ3dlmTj7wPDXktRi9HTN/amzjcSsrnH2Zp3r2/RGjH+V4B8RqTfGT7fhYHMYzKLR9 DtpxdOjcrPbh7z38/lvJOaR5Jqc3m1H/mDkOm9+fnu2Q55r2ybrefOyZmK3l02ulUcn6hP7s tvOo/GPbBxZjyiFn6c+fy8DjtNaPfk0/qZ/TvWw8E9bo2/ql8Equ/tkeNwOJNx+cuZWrlMv1 aycp56+wveaFKzHr9FL9Y4l3yOy8GhbPfL2j+P2B8pVynDWbY+bNMnNvHIsQfsT8PBwN7PsG 5t0eO+Mv7Z2t07cBtTto49O4qj17GOfdYalYy9nUgC7UU/QI3RJjyDxg+LjytZweYw/1TkrS eLvOCs9CKza+EkAlrKmT38rwXldpHLbZGjQ4nIP56hGtjOsrjNV3qm2Vsm6YWeVAirg9ugl6 uq3ENTvKQI9/RA/7/qjZT9sGOSeWfHcFuDTr/500R9t0J32bQUhjz2D/HM4/0j/ZeGjxQQ+m 6L/qoWTsrzXl07HT3Q7Qjj2nt8SybQdQX/925PujZeDyu66BhTPKXIxZW09una+8awfm+cQJ Un5o3zY+/C2xsm51TjL/CW8Y409irU+POHWSlFJCiO96y8m0/Kkc20otI0PvPd1rFmXf9OfW ZjjZ+mh0SoT53baT/bIBI005ntbYteTi1S/7jvCBvhUpvZfZOXI9akuqHCXmlge1TesftNfC tcATe3vct+8o//+wpZYnk1nDL0euRSVHFvMdB8apgt/nKeTvsWH+uvP4I5beVw7Oi8vzhr6d +ecccnagLhOOkctocCpdAx09zZuxRovjOdYOWHtsBLLr4ad53aaklCfFZ20Yvj3iUpPwW4Lk Et8dlIXzfNTb/AOlmJgNB76FOFBeK1vSIfKUOBt0kFsY3o4fS2zmm4dm5qinxt/XKKOcbyPf 22Hcxuza99TwHg5I0OwwOd8ue0nFedcc/UvG4+T6peSdGw5HPn0pdSvXSgNaacPxqY7IlRP2 d/vM3z4POvA+ReQYX6CY+0ily8rT3/WG460AHzXXijDEn2qY1e0tFD7dOEau+Gpp6qH9Ty/X G+3Xnk2oBo722ShGHzvrsNr0j7LLd0zZv7b7Yptf99Ud9Bt6tH06fLDPtNNv2mPhke9dHOUL wTy9+fdZzbdvhMSfVS3HHGcxrNPlmF8Xfxljn9iYlfxL9S32/HvdDVT36zm4oyn6oXBd85Bn WnYc6aT/Ug5puoDr9WHcxux3w6P1ZP2VflHfob+xGpFqn2wvOmBR6QdNGjUwT4d0d93VphWg zlfrcbiXyfoj/W74BOeQNSw7NgzTz5dDzgl6dvFq3mz9BvbvhfORLP2xfh5p20LShBKWfxwB 65e9vNO9nY4nMlar4u8rHKHvp6H0jHI9j8uhEiswofYdn08FhIrUxsbrY15fj+qa+0fPMv/w 8wdqDDzKRMhG78tGz7kWOJGoz7P00eLS+us2YTT+5Pmb4u85Vfztl5Du81JkjyPeaOC9HXH0 AH2D/hfCQKqrW1mSEN/tF9it9eW6s74dsekmQL5x+j091757Ey+tNjWkGI7223Jo/MTj1sOR Mn0UD+HZVNxTiecY4ds16Zhp1iLzX3wHviOfUYKmStF27esr9Drg0kzdFTzG6OdwX1P1syVr hQ58z/1EHB/KKGcf6Ev8G2EXsa76Pv2s1aHl9o3PII75JSwh++V5/M2AE54HHFripiO/aTyB XHlh37UWrn12s4OkvZR4jPHd5Eili9D+nL49jt+htqHfoSfoz4yzytTR+hTqbX0KDbY+hZ5m bdntNJzdx+6jF6w3oRdZT/Y0jWFD2WiaZHwK0VTjU4imGZ9C9KXxKUTT2ddsPs3k5/JmNI83 5xfQAuNTiBbzS/gl9LPxKURL+J/5NbSMd+PdaQXvzfvQSj6cP0+r+AQ+gTL5O3wSZfHP+BT6 jX/Bv6DN/Es+g7bwb/i3lMfn8rm0g//E59FOvoAvpAK+mC+m3XwpX0p7hC8C2iuSREXaZ/wC kbZ+gcj6BXJFfVGfKesXyLO+gKLiAnEBC6wvoJj1BZRkfQFVtF6AKom2oh1LFu3FHayK+faC VTW+elg146uHne1McWawtsZXD7vL+OdhnYx/HnaPm+RWYJ3dZDeV3We89LCuxksP62W89LBH jJce1s946WH9jZceNsB46WED3Xy3kD1lPPOwZ41nHjbKeOZhrxnPPOx145mHjTeeedh7xjMP m24887AZxjMPm28887ClxjMP22c88zBtPPNwbjzzcGE883DXeObhUo6T47lvfPLwJOOTh1cw Pnl4NeOTh9cxPnl4A+OThzeUi+VyfrbxxsObG288/HyZLX/jLYw3Hn6R8cbD/2S88fBrjDce 3sl44+E9zNcYvLfHPc77eNJTvK8X9aK8n5foJfH+XrKXzAd4Vb1U/phX06vJn/DqeHX5v43/ HD7Q+M/hTxn/OXyI18xrxp8xXnT4UONFhz9rvOjwYd5l3mV8hPGlw0caXzr8ReNLh48yvnT4 GONLh7/i3eN15mONLx3+mtfD68HfMB51+JvGow4fbzzq8AneEG8If8cb6g3l//GGecP5u8aj Dp9oPOrw941HHf6x8ajDPzW+dPhk40uHTzG+dPjnxpcO/8L40uHTjC8d/qXxpcOnG186fIbx pcO/SkhNqMFnGS86/DvjRYfPMV50+ALjFYcvNF5x+C7jFUeQ8YojPOMVRyRFb4reLdLNlxzi cuMVR1ztKz9R3Gj84Yjb/Hb+veJh4w9HDDT+cMQzxh+OeM74wxEjjD8cMdL4wxFjjT8cMd74 wxETjD8c8Y7xhyM+9if4E8Unxh+OmGb84YivjT8cMdv4wxHfGX84Yo7xhyMWGH84YpnxhyOW G3844ld/rZ8p1hpvNiLLeLMR64w3G5FjvNmIrcabjdhuvNmInTEe80R+zI/FxL5YxViy0MaD jcNju2K7HDeREpkjibOvgVAxIFEiJRHD2FqBBEbXFKRWpepA3hrUAOkN8VPUiM4kj84CoiUg RyuMfRdRa4ypFwPdfItuvkW3AOh2C3L9Hb9EYNzt4N2e7kaOjiHedUM53fFrTT2oN1WiPvgl U196lCrTAKBhFaChTyksYDGqar8OS2VJwMdqwMdGSGnMGlNT1oSdgfQz2ZmInwXcTLG4eTZw 83rs/wr0vNR6ZEthtwNDz7EYeo7F0HOBof2Q3p8NomZsMBsMnkOAqqlA1WGUzoazF+k8NgoI e7ZF2LMtwp5tEbYpEPZdxN8DzjYFzn5LV7LZbDa1YN+xH+gP7Ecg74UWeTmQtzn25wN/pcXf mMVfbvE3ZvG3osXfiy3+nmXxt7nF3+rA33cpjb/H36MafCL/gGrzSUDkOhaR61hErgVE/hL7 6cDlmhaX61lcrgFc/gn7eUDnWkDnBdgvBEbXtBhd02J0XWC0T/VFAKRuYJG6kUXqhkDqqtRE pIpUOkNUE9XoEoPaiAO1qTFQuxH2jUUT5AJ205kGu5GrpWiJfSvRCldbi9bYXywuBg1wHHvg OFLMd3aX2+/srrDf1l1uv627wn5PdxkwfQC1dB5zBhEDsg+nwBnhjKLzndHOGKrgvOS8Rhc4 rztvUGXnTecDSnEmOZOpKtB/Cp1j/LVRMzMG0B/MGEARMwZgn+Qm0UVuBbcCnW1GAjoHI8HP JNwl7hKq5S51l1LgLnOXkeMud38hFyPESqRkuBlIWeWuIuWudleT565x11AlM3JQ1IwcoNno bqREN8fNoSSMH78Rc3PdzShri7uVKrjb3G1U2YwoKCvfzacqboFbQBe6u9xdkGq3uxuS7HH3 IL7X3Yt4oVtILd397n5wLpKcKkghHWopXekSwzikCDAuPYrKBBmhQEZllIT0pU9VZCADulDG ZAw0GKsoEWNVJeRNlpWRt6pMBX01WZ2SZA1ZE5zTZBry1pF1sK8r64JDPVkP9PVlfdA3kI1B 30Q2ocryDHkG0s+UZ5Ijz5JnkS+byrPB/xx5DvKeK88Ft2ayGWjSZTrynifPo4gZF1FWC9kC 6X+QLUHZSrYCh4vkpeTKy+RVoGwj25CSf5R/hMzXyxtwX3+TN4P/7bIDSr9T3oVS7pb3gE9n +QC1kl1kV7pIPiR7oMSeshe1lg9L4IbsI/tSsnxEPgJp+8lHcS8D5GPg87h8HByekE+Aw5Py SfAfKAfi6lPyKfDH2EypZmymphibR1AzOVKOpHPNCE0pGKFH4+r/UnbGcU3d997/5SQ5CXig VC0iUkYppRSVUmSUokW0jlpLqbXOOeeVACGEGE5CCCGEkJyEkETLnGWOMsuss845ayljzDHn dc7rHNf6cr6oc16vs87rY71eH+d1zPlYL30+v2+QuT1/PT2v7yfffs8vv5ycJOf3/vJKPvaJ fSxF/K6Iz774rvguKxb7xX6c553iTuj3xV3sWe6sh/FYxTHDB+IH0P0i3pnigDiA+34kDrIy 8cfijzHzkPgT7D0gHsB9fyb+DPUR8SBG/kI8hJG/FI9g76/Eo6yAr/2o/6v4rxh5QjyB/GPx Y4w5Kf4WY06Lp3Ekn4if4KjOiL/DcZ4Vz7JU8ffi79kC8Zx4DvcCK2D8RfEiZvtU/BTjPxM/ wzzXxOsY/1/if2H8f4t/wZg74h2cgb+Kf8Xx3BXvs1mcJ1g+eCIBeaLuUfacbrpuBputm6mb xQp0Kbo0tkD3uC6D5YE2nmbFuhzdM2yZLlc3lz2vm6ebh8p83bPsBV2+Lh8zPKd7DiMLdAUY s0C3AHsLdYWol+hK8CgLdQsxcpFuEeov6l7Eo/DfkKo4tbBnObVAQS1QUAsU1AIFtUBBLVBQ CxTUwlI4tbDZnFqgoBaWyqkFOaiFFXNqYbM4tWA8qAU5qAV7QS1QUAsr4NTCFoBaTBhfr69n L4BdbCxBb9c3YQwIBvcFwaAOgsFIRa9gnoA+gDyoD6IOmsGRgGYw/lv6b7Hn9Fv1W3EvMA3L B9P0ovKOHu8ufZ/+XeQ/1P8Qj7VXv5ct45SDym39bczwZ/2fMQasw+Zz1mGz4/gfPsriVHEq NosTDyogHij+Y/NBPFgf45LiklgBuGcGK46bGTeT5cc9FvcYe4H7CbLn4lLjUllq3Jy4OcjT 4tIwD6iIPQcqepMlxq+OX83E+K/GfxX5mvg1yL8W/zXka+PXsemcmVCJxO9mQvwP4vcjBzkh BzlhDMgJY/7PNBUTpgnTUlkp5ydWGPslLOcnJnB+goKfoN+QvsHSpPXSevYl6Z+kf2KPSBuk DSxdqpKqWKZkkAzsCalaqmZqqUaqQ26STBhfL9VjjFkyY8xGaSNyq9TInpRkScYYm2THGIfk wN5myckeB5O1ou6W3KiDzKBeyQvtkHxsjuSXFJYhBaQgRnZKnRgZkrrwiFHpLVS6pS2YGfSG R+mReqDflrZhTK/0Do65T+rDPN+VtiN/V3oX4/ulfuTfk76HOXdIO7D3Pek9li3tlHayHM58 7Gkw326WK/1A+gFbLO2RfoR8n7QPYz6QPsDej6SPoIPSj9lcaUgawt6fSMPY+zNphD0j/Vw6 iMovpF+gAlKEghShv5KOsizpX6RjGPNr6Th7SvqN9BuMHJVG8Sgnpd+icloaw5zgSMx/VjoL /b10DmPOS/+OvRekC5jnD9JF5J9Kn7LnwJd/xGyXpcssm1MmexyUGWRzEjoTQuyJhK4EnCUQ Z5TNTdiUgHOV0J3QzdITvpnwTVTeTuhhuQnfTvg2W8xJFBWQKJvLSZRN5yTKBE6iUJAoIxJl 0zmJsmfBRPOIRF8iEhWIQWPEGWPNaQ+RZQL7OrYEYsqvEFO+/BBTvkJMOZOY8jFiymRiypSH XA+05HogkuuBllwPtJOOL9z1QEuuB1pyPYgn1wMtuR5oyfVAS64HErkeaMn1QCLXAy25Hiwj 14Nycj1IIteD5eR6sIJcD14l14MKcj2YBcadBuJMUCUQ3c4G3WJjhcS4RWDc10GTnGJfV31V 9XXUOcW+oDKpTOzL4NcWqEvlYSUqL1j2y2DZKFsIit2E/C3VWxjPWfbLYNl32Iug2H5WCn4d hv5U9VO2WHVA9Uvs5fz6JvFrGfHrEuLXpeDXfKYhftUQuT5C5KoBueIVArm+wmYIr4JfZ5Av Q8yxJpF8GRLJl2E6+TIkEt2+RnT7vLBJ2MwWcddhtpIYN42Idq7wkfARe0YYAdE+SSz7FLHs 08LHwscgV06xTwhjwhjqvwO5PkFeD3OEfxP+AJb9VPgUyn0fcskFJ0e4IvwvVD4TPoNyL5zH yQ8iU/jfwk3k3BUiS/hv4TZy7g2RLXwu3EfOHSLShQnhC/Y4+URkqFVqATl3i8hSa9Va5Nwz IoM8IzLV09TTUHkE3DyfiPk5IuYFRMyV6jnqNNQ5N89XPwluzlNng5vnEzc/q85V5yKfp0Yn BYZewArA0M8jL1YXs3nqF0DS84mk89WLQNLz1YvVizE/J+n5xNBvEEOvIoZ+gxh6FdHzS+Dm XnDzO2DlR4mVk4mVZxMrF2kOgJVfACsfYws1v9acZIuJmJc85GShJScLiZwsksjJooIY+mVi 6FJytSgnki4mbtYRMeuImBOIlXXEysnaK9or4OCr2s9Q4Xz8GPHxyw/xcTLxcYp2XDsO5QT8 EhGw7iECfokIWBBFELCO2FdH7JtCjPsS0a3uIa5NIZZ9iShWRxSbTBT7Esh1Pvb+jVlfIlqd JhaKhRhZJBZhJGfWl4hWY2yqIx7VEYN+hRj05YcY9BVi0JnEoI8RgyYTg6YQa6aI3WI3yPWb 4jdZIbFmMfFlidgr9qLO+TKV+LJU3CHuYEuJLAvFXSDLEiLL2USWC8U94j62GHw5gApnyteJ JheKw+Iw7sWZspCY8nUw5Qju+3OQ5WwiyyIiy4Xiv4jHMMOvxV9j/G/E32A8J8vZRJZFRJYL iSyXiGPiGGbgfFlKfFlIfLmQ+PJF4sulxJep4h/EP2AvJ8sHTHlDvIUKJ8siIstiIsvXxQlx gpUQU5YQUy4EU85CzmnyRaLJUt0TuqfYYmLKJcSUbxJTlhFBlhJBvkkEuYQIcrbued3zUE6Q S4kgl+gW6xZjTu63IpHfipb8ViTyW5HIb0X7kHfUCvJb0ZLfila3SrcKj85dV7TkuiKR60o5 ua4kketKBbmuzCLXlVnkuqIl1xUtua5oyXVFIteVpIdcVyRyXdGT64pEriuzyHVFS64rErmu aB9yXdGS64pEritacl1JIteVWeS6oiXXFYlcV2Y95LqiJdcViVxXKsh1RUuuK9qHXFe05LoS T64rErmuaMl1peIh1xUtua5I5LqiJdcViVxXtOS6oiXXFYlcV7TkurKMXFfKyXUliVxXlpPr ygpyXXmVXFcqyHVlFrmuaMl1pZxcV1aQ60rFQ64rWnJdmUWuK1r0AKBYEP9TrJT4frH+af3T bCEoP4eV6Ofq57Ii/Tz9fFYI4s9DPV+fP8n9hfoC/QK2lOi/UF+kL4byHmCJfqF+IeYp05dB y/UvQ5frX8VsFfrXMKZSX4me4XX0Awv1X9N/DXXeD7yor9JX4Uhq9DUYH/Om4h3CEnQIFjxK rENo0jswQ7O+Gfdq0bewMn2rvhWVDr0fx8/7hGLqDWaTl1UhdQgl+i36LVDeJyylPqFE/x09 rg/UJxRSh7BQ/57+PVTe17+PR+fdwhLqFt7U/0i/D/fiPcNC/Yf6DzHmI/0glPcPi/Xj+nHM wPuHYv3n+s/Zi9Q/vE79Qyn1DyVx+jg9K6T+oTguPi4eeQL6h5K4R+MexXjeRSyhLqKMuoil cclxyegxZsWlYORs9BJF1EXMjsuIy2CL0UWsZo9Q5/AIeoa1bEb8OnQOM+LXx69HpTa+li2K t8RboNZ4K1SOl6H2eDvUGe+EcoedRHLYSSSHnenksDOdHHYSyWEnkToQDfUYr02bMy2TPT9t xbQ32KJpxmketnLSCYx3HWp0GnOZhnqJudRLPCPVUS/RIFlAurx/eII6h7noHGzI7VITCN4l uVDhPcOTUrvUjkqH5AfN8z7hKeoT5lKf8Az6hM2ovIVu4RnqFp6WviV9C+N5nzBX+o7Ui73v oE94Gn3CdzEb7xOeoj7hCeoQnqQOYb70fen70Pel96G8Q1hAHUKl9CN0CPnoEPaj/qE0wJ6l DiGfOoQC6hAWoEP4CSrD0k/ZPOmAdAAjfy79HHXeJ+RJh9AnzJcOS4ex9xg6hGepN1hAvUGl dEL6GHtPSqdQ5x1CgfSJ9AlG8t5ggfRv0nnU/x29QQF6gz9gtovoEB6nDuFZ6ZJ0CY/L+4Tn qE/Ik/5DAmuR51Eu+ajlSNelG6hw/6MM6aZ0Czl3QcoiF6QMckHKJRekDHJBSicftcel/5H+ B8odkXKlLySQGPkiZQKQQWLkjpROnmqPk0fSnAR9gh45d0rKIqekXHJWy0lITHgEde6alJUw I2EGKtw7KZu8k9ITUhJSsZc7KOWSg1IWOShlk4NSZgI27OU+Slnko5RBPkqZCZYEC/of3hE9 hY4owNLQEeH9kBBJiLCn0RF1o867oALqfyrR/3wHeW9CH3uWuqCChO0J25FzP6Ys8mOaQ35M ueTHlE1+TFkxtzammnM7TcGtpN7MPmXMsA5hQJgQVoQD4Z66VTXtwa1vshZCbEZsRfQi+hG7 EHsRA4hhxEHEEcRxxEnEGOIcE4IyBTNcpBCCToQH+RXEdcQtxB3EfcaqBYQekRh77OqZiFRE xkO32Q/9/7zYXNUFiGJEKWLZQ7crECsRaybvw2/XI2oQZgSOq9o5dSsEFQpV037EEPLwVC0W 3YieydyD6JvMd0zG7snYhxhEHEAcQhydHDtK41k1P2Z+G0Z0I3rouGJjT9E4Vt2H2IHYjdiH GEQcmHy8M8gPIY4i+NhTCF47P7n//GRcQo3HVTyfEcThqefCqm8gbiPuIiYYq9Eg4hFJsfNe k4xIm7zN/Nvt1Pic2HuA39L4pNj/T+3PQxQiShBliHJExd9u+etXswqx9qHbDQjjQ7cWhH3q VghejR13jSv23Gq8k/ME//+C3tcPRygW/Dj+br5V/xBRxJbJ2+j/M48Q5Me2DbE99trU7ETs eeh2P2JI82hViVzudxou2u5ztQukeugVeyL0un0m9JY9FXrHngG9b8/2O/m9lPFqwT5PuVdV Jlf4PVXl8iq/Uq23F5AWT+WJ9lK/wvcGWFWFvNYfrp5pX+YPx/JJXSVv8HdXp9pXkK78hzzD vgaabV8PnWevgRbYzf5ufq+AWLVWNvp7qjbIFn9fdbFdhpbandBldo+/j9cDUpVRtvt3VK+w K9CV9nBgepVFdvl3V6+xd5P2kPZB19t3QGvsu6Fm+z6obB+EOu0HoB7ZFUipVuyHAulVdtnr 31cdth/176tyyUH/YHW3HAxkVXnlqP9AdY99FNpnPwXdIUcDudW7qb6Da1VQ3uI/VBWVt/mP Vu+zn5nSQft5/1FeD+RP6hZ5u3+0+gD2cr00lR+yX4Uetd+AjtpvQ0/Z707pGftEoKj6fJMm sKhqm7zTf6r6UlO8/xTNdmaycrUpCXqDK68EllZtl/f4z1ffxjnnuuJBzuuB5VU75f3+S9V3 m5L9l3geqKyeaEpDvkce8l+t0TRlkuZM5fFNedCkpkJoclMJNK2pDJrZVE55BTRHHgqsrtov j/hvVA3Jh/23a/KaVgXW/Z0WNq0NrKsakY/571Ydlk/4J2pKmjaQGqfysiaLf6LqmHxa0dSU N9mntKLJpWiqTshnlXjLoOcm6TjpPeiBdgY91C5Cj7ZL0NH26dBT7SlKPL9XqNJypj09srfq tHxBSao6K19Wki3n27Ogl9pzSXl+tT1fSeZ7IwNVF+Rr/kHLjfYi/2Asn9TL8k0lzXK7fRHp 0n/I77Yvh060VyppGzXtq6Hx7euUNH6vyHDVNXlcyay6Kd9TcjYmtRugye0maFq7Vcnh9cjB qnEbU/I2ZrY7oDnt7siRqns2USncmNfuIw2RboYWtm+FlrT3Qsva+6Hl7bugFe17lUJ+r8jx javaB8KXDcywXCnZuLZ9WCkxiDZJKeMaOWmQbNOV8o0b2g9Cje1HlHJeiYzF6pM63ZaiVBhS bOnKqo2W9uNTam8/qazi9ci5SU23ZSlrN7rax0jPTeXe9ovQYPsVaLT9OnRL+y3otvY70O3t 9yMXN+70CpErhixbrrJh4x6vXtlAsxknK/u9iQ+UVyLXDbm2fMWycQivHdQ780HO65Fbhnxb EX9e3lQcP/LI2MYRbwbyItsixb7xsDebdN5UfsxbAD3hLYae9pZCz3qXQS94V0Ave1cqdn7f yB3DIttSxWVYaluueDde866Z0puk4971ihfnthJneLlttRLceM9bQ2p+kFuZV1aCVdds65RM q+h1Tqnk9SiZhkqbQYnWrGrykgan8rVNUeiGpi1QY9M2qKVpO9TetFOJ8nsFDDWupj0Bk2G1 zaRsMayzWZVtNd6m/dAgaZR0S9OQso3vDVgNBptD2W4wNI1w5XnNtqbDyn6Dyeb299RsbzpG euIf8p1Np6F7ms5C9zddgA41Xfb38HsFHAarzafsNDhsIWVPzUjTNejhppvQY03j0BNN95Q9 Brdts7K/5jTpWQcLuA0+21ZlqOaCQySVSKcrQwafIwX5ZUc69JojC3rTkcvrtq0BX824Ix+V e46iQMgQsvUqI7XMsQgqOpYqI4bNtn7lcK1k6w9srp3uWK4cNmy17VKGalMcldB0x2rMg0rA R7o1ttfQa9urHDP02waU/bVZjnVTmusw4MygHuitzXeYAv2x3LDLNqycqC1yWEkdU7rI4YYu dfigyx0haKVjM3S1Yyt0naM3sKvW4OgP7MU8B5XTtSbHLuU08iPQvbbjOEKrYy/pAI4KFRzn gO2kcrbW4Rj+e+X1wECt23EwMFzrcxxRCg3DtjHlQm3IcVy5wPPAQcOw4yTyg7Zz9IzGSP+W 5zouQjc7rkC3Oq5Dex23oP2OO3iNtjnu47njvni+R2wX/ecNx21XlMu1u5qFKd1LOtCsVy4b TtquK9cMY7Zb/D3QnEg684HWDjen4j1wznZHuVl7sDljSo80Z0OPN88LHKk9KZcHjteONReA TzgbnKw911zs76692FwKvdK8bHIFH+PrYOBc7fXmFf7R2lvNK/2jtBJdrL3TvIavSs3r/Vdr 78snAleMQnONf8Kobzb7J+jzct2Y2Czjs8Pft7eMM5ud/h5jarMHmtGsTL7H7vDXN3DfmN0c Vk4YdjV3Q3EegoJxXnMPPyfNfVB6psaC5h3Q4ubdyh6+4kTuW6d7Faw+uPJHBWuKN6ykWdO9 3dAsb0/s+hzV86tcNNGa6+1T1lrzvTuUtfw6E51pLfLu5tcc7z4oriTRVOsi7yCuHku9B5Qg f+cHfMbS5n1KhXFZ82BQb1zRfCCYaFzZfMh/ybim+ahfMa5vHvWHjTXNp4IzMeYMxpibzwdT jXLzpcB0o7P5qrLN6Gm+EcwwKs23/X3GcPNd/w1jd/NEMNvY49QE5xn7nPH+QeMOZ1KwwLjb mRwsNu5zpvlHjYPOzGCp8YAzJ7jMeMiZF1wR4w3jUWdhcKVx1FkSXMOJIlBpPOUsC643nnGW 81fBWRGsia3sxvPOVdBLzrXQq84NQbPxhtMYlI23nZag03jXaQ96jBNOV1Cp0zi9wXBdvDMY 7I4xbfUaZxSvPrFTjFLqkpxbglPc6Nzm76tLdm7HSo33RrCvetS5M9hXl+bcE9xRl+ncH9xd l+McCjrr8mhkoXPEf7SuxHk4uK+uzHkMebnzhN9ZV+E8DV3lPOvvrlvrvADd4Lzs311ndF6D Wpw3/aN1duc41OW85z9V521h0GCLiOOJtkjQLS3Tg4PVK1pS/DvqtrWkBw/UbW/JAnvgDAQP 1e1syZ18bxvq9rTkY579LUX+ibqhlkXBo3UjLUuDo3WHOWHWHWtZHjxVd6KlMniGfy6C5+tO t6wGpYPVg5dIr9adbVkXI/DgDdLbpHdJJ/ijdGpiWnehxeDvqbvcYsJzv9ZixbHdlO2d8XXj LY7JPIk0mX++OtPq7vEzyXm4M5M0h3NvZ56Jtbg78ygvJC0xiS0+/yGT1BICD4OKO8tM01s2 xxi4s5y0gnRV9dWWrf5TppSWXmg6V06tnWtJN5iyWvpjpNppNOW27PKfN+W37IWijkpRy0CM WjstpHZSF//Ud3pJgzE1LWoZ9t8wLZVHOqOm5S0H/bdNlfLhzi2m1S1H/HdN61qOQw0tJ/0T JlPLGNgSr0vnNtLtJmvLuWBirakFV0WTo+VK506Tu+V65x5UcFU0+Vru4MhDLfc795s2u4TO IdNWl145bOp1JXaOmPpdMzsPo57aecy0y5XRecK015WNqzpdvU0Drnmdp03DrgJcjcdcxZ1n Y1dC00FXaecF0xHXss7LpuOuFZ3XTCddKztvmsaIAS641mAtiK0ydN2OrdGmc671WPGx2naO my7y1dZ0xVWDlQ5Xrc57tctd5s57pusuOcRMt1xOZcR0x+XpvBxbl2uzXAqey31XmLOEq1uJ 1guuHr6mu/r8PfV6144Hq219oms3X79c+5QT9TNdg6ikug5AM1yHHqwU9dmuoyGxfp5rFHmB 61RIqi92nQlN588ulFJf6jo/eaV11C9zXcI8K1xXlT31K103Qun1a1y3Q1k4M3dDufXrXROh /PqaVk2oqN7cGh9axM9baCnNs7yWtSYpI/Vya3Kokl/DQ6snaQcaWkdqeEA1NkfIREqcE3KQ uvkxhHykoXpna5qys35FayaOxMNppF6xbQ4K9eHWnFge2ky6la8FoV5+1Q311nfTGQZdhPpJ dxE/3Knvac3DeoE8tJe0t76vtVA5Vr+jtQREAa4IDdTvbi2LUURQ4BoaJt1am9VarpzG3gro vtZVkyv+Ha6hg/WDrWtjq3zoSP2B1g3K2fpDrUYo6qgcbbXEVvnQcdKTpGN8nQqdI91KerF+ tNWOtRsreKex/lSrCys11vHQlfozrV7lWv351qByreZYaxTvjYOtW5SbdM6vk96i8zBcf6l1 m3Kh/mrrduVy/Y3WnVjTiULrb7fuUQqty72HohnWSu/R0H3rau9oNNu6znuqa9Rq8J6JzrOa vOf9g1ar9xKNuYoxDu8NcK/beztaYPV570aLrSHvRLTUurlDE11m3doRjxl6O5KiK6z9HcnR ldZdHWlKmXVvR2Z0jXWgIye63jrckYd182BHYbTGeqSjxH/DeryjLGqOdQfWkx3lSrl1rKMi KltPejMiY9ZzHauiTuvFjrV8Ve3YEPVMcviVDiOpBXq9wx5VrLc6XNGw9U6HN9ptvd8RjPY0 Ch3RaF+jvmNLdEdjYse26O5YB7oxr2M7eq5Yp0M9RePMjp3RfbEurzG1Yw80o2M/OgK+1g9u jHYMRQetYsdI9EBjdsfhaLhxXsexaPfGJBpZ0HEiPNRY3HE6eijWZ1kGO9DzNpZ2XEA/e7vj spLWuKzjGvrKvI6bSmHjio7xB4/euLLjHo6BuqTGNT6Gjil2POt9IrTGJ0WPbsz0TVfyGs2+ lOhoo+xL9/fwMxA91ej0ZcVYJTLc6PHlYjbFl68EG8O+ouiZxm7fouj5WD/Y2ONbGr3U2Odb Hr3KOSd6o3GHrxLrGjrr6G3Su427fatj/XJ0gmtnDtdAFtdNGv4om+ixNiVZJR/Of+M+H3rh xkGfScnj/e+m5MYDPutknkaayXlp04Mzie51Ux5pIT+qTSWNh3yOTSWUl5GWNx71uZWKxlGf D90rethNFY2nfKFYx7oppmtJ0Vf6NuOMnfFtfaC8xwzc57rJ2Hje1xvrKzdZGi/5+hVL41Xf LijqqNzw7Y31mHh0rmWk1Gluop5xk4vU23jbN4DOEf3jpmDjXd8w+kR0kZuijRO+g0qZrPEd gcb7joPxRN9JJZO/Lpu2kG6rGveNbdouJ/nOKeVysu+i4pXTfFeUoJzpu67E199t3a9ETZtb h3DVmmgdAaO6cVXcb9a0Hu68YI5vPRa6Y05qPRHoNSe3ng64zWmt6N2m9ELovjmz9XKXAL1G ehOa0zrepTfntd7rSjQXtp4GsVNPZ9rsZpi5xC12zTSXuaWuVHO5e3pXhmkvv35yxaNUuFO6 ss2rHPld88xroQU14250cOYN7qyuYrPRndtVara487uWme3uoq4VZpd7kXKMa9dKfp3sWjPZ W5Gave6l/rvmoG24a7056l7eVWPe4q7sMpu3uVd3yebt7nVdTvNOtwG63W3q8pj3uK1dCmnY vN/t6OqGuqFDbl9wEBoKDvJraVePecS9uavPfNi9tWuH+Zi7t2u3+YS7v2uf+bR7V9cgv4p2 HTCfde/tOmS+4B5Q7ObL7uGuo+Zr7oP+8+ab7iO4Bq5wH+8aNY+7T3adiq1QXLvOGM65jnad N5xzj3VdipFb3Qn3ua6r5nvui103Gpj7Stftqi3u6/7RBtF9q+tug+S+06VvmO6+3zXRkNIm BNc0pLfpw5qGrLbEcHxDbtvMcFJDfltqOPnh2RqK2jLCadDscGbDorZ54ZyGpW0F4byG5W3F 4cKGyrbScEnD6rZl4bKGdW0rwuUNhraV4YoGU9ua8KoGa9v68NoGR1tNeAPUHDY2uNvksKXB 1+YM2xtCbZ6AqWFzmxJ2NWxtC4e9Db1t3eHgpPa39YSjsXdLzXhbX3hLw662HeFtDXvbdoe3 Nwy07QvvbBhuGwzvaTjYdiC8v+FI26HwEOY5inmOt42GRxpOtp0KH24YazsTPtZwru18YG/D xbZL4RP1E21XlRMNV9puQK+33Q6fbrjVdtd/CToBvePRhM823PfEhy9YBE9S+LJF70kOX7Mk etLCNy0zPZnhcUuqJyd8z5LhyVMslmxPYYRZ5nlKlLOWAk9Z111Lsac8IlpKPRXBQcsyzyoc Gz2KZYVnbUSyrPRsiEw3rPYYIykGg8eibLes8dgj6YZejyuSZej3eCO50KBy2rLeE43kQ7dE 8g0Dnm2RIkuNZ7uSaTjn2RlZZDF79kSWWmTP/shyi9MzFKm0eDwjkdUNuzyHcZagkXWxrt+i eI5FDJaw50SE/m4TIVaJOCzdNl/EHfvEccYI5E7+peLvPx0HY38riP1loKvH0uM5HfHx9T0S 4j14ZPPke5L+OsT/thDotfR5zka2xkjMssNzAbrbczngmPzrDf1dxayxWSO9/NMR6Y91/ZZ9 nmuRXdR13mECm6W6pfpvxlR/UeH/VPdUnzON6gtBxURBK4gsTpgmSGyakCQ8yhKEx4Rk9oiQ KsxhjwqZwpNshpAjPMMeE74nfI/NUi9Xv8JStOXal1mq1qFtZmnaX2l/xdITsbEvJWYkvsYy ElcmrmeViVWJXewbiW8n/pIFE0cTb7AfJ95MvMPO4mjeYBr6/Woie4TFsUfZajaNrWE17HVm ZG+x9eybbAsLsa3sExZmv2N/ZCfYf6ji2e9VkiqBfaF6RPWYSqVKVeWo9Pz7i6pZqnWqelWa qkEVVuWqoqptquWqPtX3VF9V/VT1W9U31B+qP1S5NE5Ni6pVo2iCqjZNVPOWyqt5W/O2StG8 o/muKqB5T/O+KqQZ0AyqNmkOaH6u6tb8UvNL1VbNrzW/Ub1Nv/7bphnTfKJ6R3NRc0n1Xc1V zX+q+jV/0vxJtVPzF81fVd/n32ZT7dbO0M5Q/VD7iXZCtVfUilmqM+LT4tOqcfEZMU/1F/F5 sUT1Of+lguoL8SVxmaARy8XXBFF8XVwvJIrVolFIE02iQ8gQW0SfMF/cJG4Rnhe3iv3Ci+J7 4h5hBf8dgLBKHBA/Ft4UT4mnhCbxtHhOcIgXxAtCu3hJvCR4xc/E60IH/76UEBD/LI4LYfGO OCFEdUyXILytm657THhPN0v3pPC+Llv3ZWFQt0RnFY7omnU9wg3dd3TfUfPv+vSrE3Qf6AbU M/i/B6eepfuZbkSdpjuo+5U6nX9fR52t+53unLpQd153VV2s+0/dX9Vf0Wfrh9Sr9X+Oe0L9 x8TPEz/X8F98WVkUKrF0/ovgJbcQ9xlbWoDIZtnyrlcs8l55QB5+Zb98UD4iH5dPymPyOZv+ Dact0TbTlvrGAVuGLds2z1ZgK7aVVtx7Lf3lXZWH5IuvMfmKfF2+Jd+R79uE19Jf7ca7SoP3 +C16j/+FqVRfqL5gAt7RSUyNfY/TN0KZ8IHwAVMJHwofYt+g8GOmFv5Z+GempW+EisJvhd8y Pf2WKU74RDjD4um7oBJ9CzRB+KPwR5ZI3/98RPiT8KcH//qXWqVWTf1rh1q1yJLpt08p6mR1 MputTlGnsFT6xuYcdY46hz1Ov2tKVy9SL2IZ9CumJ9Rl6iUsk37jkUXf2XgKxy+pptOZ48rk NAZ+kDPlHDlPLpRL5DK5XK6QV8lroRtko2yR7QiX7JWDchT7tsjb5O3yTnmPvF8ekkfkw/Ix +YR8Wj4rX5AvQ6/JN+Vx7BuX79mYDVRmA2/ZQLs2UNPfbUdsYCEbuGdqq7Sttq2zGR7aTDar zWFz23wY+7ftuO0kNGTbbNtq67X1T227bHttA7Zh2g5ivjHUimznkF20XUF23XYLcxbZ7tju 2wXbZjx/VZx18qrBf1f+KJ2TFGxqloZNw7LZ00zL5mHTsWex6VkJtji2CFs8K8U2jS1jX6Hf D76Kq07sl4NfZ+vol4MbMJ8R2wxmxjaTNTMne4y1MQ+bxfzYZrNObKm4Hr3N5rB3sD3O3sWW zn7A9rAvsQ+wPcEGsP1f9r4HOqqr3PecmTOTNMZpGlMKNE0phEhTGmhIU5piijRFpGEyM0lT igFpwJkzf86Zk8n8D6UYMXKRxaPIpRF5lMdCLo+HFBEpRYoUkUbkIdJcRB7SyMVcSpEiIiJN c9/3/c6ZZAipxXXvW+utpWuv3+/s2efb39l/vu/bex8mw0jhDUqjhB9RKhTepDRa+IlwkNp3 mNIY/P+dDwonhV8LxcJvKI0V/o3Sw8K/UyoRrgh/pLZfF/4iPCL0UpogmsQMoUzMothXge9x P0GxL0eYhO9xV4oF4gPCk+IocZTwFP5isYqioUN4Gv/P3VRxtjhX+ILYKDYKz+A73dX4+8QZ YkAMCHYxKAaFGjEiRgWH+KLYKrgodrYJMyl6/pPwvPhNcZnwJXGFuEKYjb9PnEORdLfwZXGP uEeYJ+4X3xLmi4fEtwW3+DPxZ4Is/lw8Inhhv36KAmOEQGZxZrEQxLfntMxHMkuFJnxjrjmz IrNCCGdWZlYKEfy9TBTfj4tlzs18QUhkzsucJ7TQ3HYL12D75fx7N0ouYSihgFBIKDYw3kA5 YZLwnDJUKVAKlWJlvFKuTFKmKNMUu1KnzFLmKm4lQClEiCsLlcXKUmWFslpZq2xQNivblJ3K HmW/ckg5ohxXTipnlHPKBeWyck3pUU2UMlWbmqcOV0eoRepYtVSdqFYqh9QqdbrqUOvVLrVB bVRlVVXDalJdpLapy9SVajuldepGdYu6ndIuda96QO1Qj6qd6ilK3epF9Qr/v2iWRouXFsHZ tjlksSayz/8q+55B6U5YeQ6s/C5Y+Wdg5Xmw8rth5UNg5UNh5cNh5ffCyvNh5QWw8vth5SNg 5SNh5aNg5YWw8tGw8iJY+Wdh5Q8KRygVw9Yfgq2Pha2XwNbHwdbHw9Yfga1PgK0/SrZuEsph 34/Bvh8X7xMLyO7ZsifBsj8Hy67E3yk8CWueDGv+PKx5Cqz5KbLmF8kHXhJfIh/gv1b4Aqx5 Gqx5uvgt8VvkD2zT1fg7hRmwZjus2SEeITt2iUfFo0Jt5rOZzwp1mbMyZwnPZnozvfwXxzmL cpbSPGXT2H9KEMM7BCGwlLCCsJqwlsp203UDYTNhG2Enle2T7gosC69WC/86IFMcLQmsDK8N tIc3qONvBpcF1oU3q+WESdEyRmBjeJs65a+DZQJbwjsD28N71Gn94M+BXeH9qp1QF60I7A0f Umf9dUBmbnRy4ED4iOoOHwl0hI8DR8Mn1QAhFJ2KfDxarS6MugKd4TOBU+Fz6uJ+4PPS6MxA V/iCuuITsDo6Bzq6w5eBi+FrgSvhHnWtDs4HrkdM6oZ+8OdAbyRT3RzJ5CtDkSI2ddsng+WU rEiekhMZru68GcqQyAglP1Kk7rkZysjIWHV/P5QxkdLbQfOq5BGlJDJRKYtUDoqKSBWjeU3y OEOZHJl+W5gacSjVkfqPQ/P65EnFFWm4HYQ2Jk4rMyONwJyIDMyPqIzmTckzfA11JrObtybP Kb5IWNEiyYEIbU+cV6KRRZ+E5h3JC827k5eVBZE2oDWyTFkSWXkTlkfab8GqyLqbsCay8bax PrJF2RTZfgu2RnYpOyJ7b8HAsd4dOXA7UA9F5yv7Ih3KwcjRQUH31CNRn3o8qkHucKTztnAs cmpQ22F9JwlnolHlRKTrdqCeiy5QTke6+3A2crEPfP8C4XK0Fflr0SVqT3S5cj5yBe0dgKAp ugr5S5Hrn4RgZnRN0BZdf5OOq5Hem3AjKg1EMC+6KTg8ulUVolnBEdEduBZFdw/Wno+Dao3m qNnRIbcgN5qvDo2OvAUF0THpCI6N7kvF9ptisRErUzEuWBo9mIpBwYnRw+lxpM9O0uc1NS+p MaqMHusb26roifQ2IZbso5hC9th8ULfL5sOGD7NfHSOcSF5je28+TTib7EnZc/N5utJzgtOj p4OO6NlgffR8sCF6KdgYvcrrS1CO3uBy9I3WiKAaE3gtCYZj1mAylh1cFMsNtsWGBpfFCoIr Y4Uc27nPwfZYcXBdbDzH5+DGWHlwS2xScHtsCuIyxXQei+Cu2DSOncG9MTvrDR6I1QU7YrOC R2Nzg50xd/BULBDsioWC3bE41kheg3hN4DG8GC0JXokt5HUseJ3Wn9Q498bsmhRbzDr4npYV W6rlxFZg7UmttWlz1KeTYawpqbWA28VrozYktlrLj63VRsY29M0zy9Pc8dxrY2KbtZLYNq0s tlOriO1B2WRaw1fq4PWa1+2bsFFfl7Wp4Z1Yj+k5qbWYrwDZD/o2YI3lK0OrDp9h8PqYWldT 0Fzhy4y+NZLXTGNtTF8r09fI1DqZgjaT1kFaC7H20XqozYmMYMBueZ0bqUObH9vPdqn5Yoc0 LXYE+WjsuLYgdhI2S/FDa42d0ZbEzuHe8tgFXFfFLmtrYtfYb7X1sR72J/RrU9ykbY1najvi NvhFyg+MuMixVNsdz+M4p+2j2GT4iHYwPpzjFtdPxcBbfGuAX/XFF8O3WAfHTe1w9Kp2LD6C 29hXn+TZ37QT8SLtdHysdjZeqp2PT9QuxSu53RyTuA/a1XiVdiOurw2fFIOMdjUJRhxPxaWT aTJGm9HXAfG4rz8ch1P4uGd9TDxtshrX7GgWz0UKt8TJ9FjJ8TEVI9PiIctCD8twbKIxaMqN bm2+1GLiOW6+2pLJ/Wy+0WILCy15YWvLcC5HzNKSm8PZLSOwfyG7Y9lwbksR9hu07wgPbRmL PQXFtHBBSyn2acaeIFzYMjFc3FLJ6394fEsVx7pweQtiYXhSi4PBPhqe0lIfntbSELa3NHIc Dte1yOFZLSr2ZBQvw3Nbwqjrbkn27Zl4z2PsUaDL0MH3woGWRc2u5FK0K7W3S+0NXP0xGEjt YYy9B+uCjlBLW2h4woU6qfoszzGaP7Nd8Bhw3+Ity1DG+8YUjH3iTbidvSC3LbWnS9vX9YH3 cykM3Nel9miD7M3CC3V84t6M917p+y/ec6X2Xel7LG4r12WZ1JgYvtU0NO7AtSBe31QYb4Ct 8p4n5VfF8cam8XEZKI+rTZPi4aYp8WTTtPiiJnu8DaiLL2uaFV+Zbu9Nc+PtgDu+jv2rKRDf 2BSKb2mKx7c3LYzvGtTf6HzQtDi+t2lp/EDTinhH0+r40ZS/Na2Nd/blN8RPAZvjXQz43rZ4 d9PO+EVc98SvpHywaX/8etOheG/TkYTU53/kV03HE1loz8lEDsespjOJIbz2pMB7yqZzifym C4mR6PPlxJima4kSjl0cP5p6EmW8pqTkQ6ZERSgzMTlkS0wN5SWq2R5DIxIzQ0WJOaGxifmh 0oSP9wWhiQmN9fD4hSoT0VBVYgH2tjT/oemJ1pAjsQSoTyznMeexCzUkVoUaE2tCcmJ9SE1s 4tgdCie2Qj6Z2BFalNgdakvs4z1gaFniYCo2h1YmDqfWpVB74lhoXeIEn0dCWxJn+UwR2pW4 FNqbuBo6kLgR6kgKPI6ho0krn0d47Q6dSuayjlBXcijPc6g7WcB+FbqYLAxdSRaHrifHh3qT 5c1SclJzVnIKr+98rzknOY19DnLU7uYhSXtzfrKueWRyFre9eUxybnNJ0s1z3lyWDDRXJEPc r+bJyXjz1OTC5urkYsQEI+ZynGyemVzBa2XznOTq5vnJtc2+5AaOd83R5LbmBcmdbLs8Xpxv bk3ugT2TLTQvSe5vXp48xOMomATR1mZbIQj/+BeUv6N/QbkoXOn/dwBvtRDwat6od4G31bvE u9y7yrvGu967ybuVeId3t7faSFFgn/eg12Wkw95j3hPe096z3vP1e72XvFe9N3yCz1rf7cv2 5T43xDe0vstX4J2vJ5Ig+Ap9xV6fnuo7nsvxjfeV1+/yTfJN8U3z2X11vlm+uT63L+AL+eK+ hb7F3pmpRBJLfSt8q31rvXP05Nvg2+zbRnI70T5uEUvyPX4iPYHf8396C9n2F/9L3oPOIN+o oXQX3oPm4j3oZ/Ae9G68Bx0iyIJPuEcIUBqOt6H34m3ofXgbej/eho7A29AH8DZ0FN6GFuJt 6Gi8Df0s3oaOwdvQB/E2tBhvQx/C29Cx5HNHhBLhKKVH8Da0FG9DJ+Bt6KN4G1ou/LvwnvCY 8D6lCrwTfQLvRD+Hd6JP4p3oZLwT/TzeiT4lFogFQhXeiT6Nd6JT8U70C3gnOg3vRL+Id6LT 8U70GbwTrRZfFF8S7OJXxa8KTrwTdeGdaC3eiT6Lt6H15OmvC8+Jb4hvCLPwTvRLeCc6G+9E vywtlb4pzMVv5TVKu6U3hPnk14cEt3Reek+QyX+vCTx/cWFhv63KeUKpnCcPl0fIRfJYSqXy RLlSrpKnyw65Xm5AWim3y+vkjfIWStvlXfJe+YDcIR+VO+VTSI2yLKtyGPXHyknwIrmNuJHS Mk5sN6aHyG4eNuwmF89nizHRHH2WrIdtRaLxLyXrYVuxwlYyyFKeJhvid+Z3kHXMIhti+/gU 7CMb78k/Tf3ykyWxNeSQLbxM9sR2kEtWsInsiS0gT/g+pbthAUNgAffQ/B8ku+X34cNozn9N Fsazfi9mPR/vwO+jmb8gFGCOR4g5NMcPYHZHYl5HYUYLxS+Lc4XRmNHP0oxqwhgxSjNajLfc D4nLaBbHYhYfNn5Hkt9pjxNfF3cL4wUxszxzUv98eOqluzz1A5PcKi/xNHgaPcv0JC/3NMir OHnkgUle41E9YT3J6z1JT1LeRCUDkrzVs86ziFIbJV3nDlxXetpTSd5NMrckeZ9nI2nY4tlu pF16kg+CDxPvvTXJxzwHPB19qc19KJX6NLcNTMH9/uWeo57OVAoe8pwyUtfAFDxCrerWU/C4 56LnopxFJQNS8GTwjOdK8JznOqVeTsEL6jFPryzJWakUvCznDEw0Oks8G72TPJ3yED25j+sp eE3Ol/ODF+T8/namtbjHvUIemUqe6/KYVCKNuu4S+cSAdFo+S88p60vn5QpO7hW39lq+5Bku T+5LLDdEnjogXSXckKuRXLLLK+jlXqs3m64zde2cvLneofKcW5O3QJ7vLZR9sJdF3mLuMSfv eG+5d5K7xzvFO81r79eTprHOfTzNnjQ56p2lJ3mBnrxz2b69btiu6g14Q2wL3jjbjHch24d3 sXzCuxS9nepd4V2NFq2G9rVyVI6ypWgmjMdGLVOz8ahqeTz62nAeae8G72bvNu9O7x7vfk+D 9xDVO0K6j3tPesLeM95z3gueNu9lat867zVvj8/ky/TZfHm+4b4RviLfWM86935fqW+ir9JX 5Zvuc/jqfQ3UYpVaudfXCC9r88k+1Rf2JX1VnrBvka+NdLHXokeQXAc/oR75lnmSvpW+dt86 T71vI+k+RHKN5Eu7fFso1+Db7ttFvNd3wNfhO+rr9J2CLyf15OvydXNvfRd9V3zXfb1+ibyV U7s/y5/jHwIbpyf58z27/CPZG/1jCCX+Mn+Ff7J/qr/ac8Dv8nT4Z7IW9jz/HP983VLlMr/P r/mj/gWyy9/qCfuX+JfL8+V8/yr/GhrlBf71/k3+rf4dZK9TaQYq/Lv9+/wHyeZc/sOUjsnV /hOwwBK5RJ8ryM1hi+G58p8mnPWf91+SS/xX6U7Uf4MWdWsgO5ArlwWG+tYFCgKFgWJPZ2B8 oJxrBCYFpgSmUbLDxiu8S1FaF5gVmCu7Au5AIBCiFA8sJBvmVBFYHFgaWEGtnu9ZFFgdWCvn BzawnQY2B7YFdgb2BPYHDgWOBMhrAyc97YEzZI8a9y1wLnAhcNk7hSw0KpcErnn309js8k4h jzuljaDYNUc9phVpYz3dWinZc6/nujaRIkWOVuk9p1WRL3e6D2nT1WPqMfZrT5XmkMdo9VqD 1uib7i0IZtNob2SrpGjG8ek6P5akSII+dWgqRSqOd7BgXZIjDOalynNRC7tXaEmy8UVUPobk Oile5Wtc46i2TFtJbWzX1mkbtS3adm0XouBFbS9HQO2A1kFPO6qt1DqRTlGck/RY59ul4Wls wVq7+7jWzdFM6ybNLHlRu6Jd13o9B7RleuRC7MrRTJTaaUxHckv85wM9Cv/EW6ZiU/IoQm1W hivD3ZvJVtYrI5QijkmeRmWsL6yUyhXKRKXS36pUyVOV6YpDqVca5JlKoyLTHVUJ+88rSWWR 0sYeqyxTVirtnkX+Nco6ZaOyRdmu7FLalb3KAaVDOap0Kqe8gtJF6FYuKleU60qvKvnGqllq jmeLcsp/3rNXHULSDZ4u/xLcwXdyPGH+Vo5/h3czfzPHs67vuzlz1PmeLtWHb+cY383x9PJ3 c5RO7znj+znLPQcG/Y7OefWS0qleJV+77s3mb+l4s4NWslMX2audZn67HA3mUmwc4z7U/80d L60WwXI5JzjUn2N8a8f4to48P1inlhjf1CnAd3X6v5mT+kbOnkAIu6mH/3HC/Ds6YcqChm81 DCEW3OcE0VMq5Lm7KHW7u2c3zG5wX6TU7m5H/or7yuyu2V3u65R63b1c5pEoZXmyuKxhYcNC Tw6lIZ4hc8rmlHnyKY30jKTnmGx2Ww09IwcnGgEnGhPOMmbseSWcZSw4xVix583AKSYTp5g7 cHL5FE4u2djz2rDnvRN73hycWe7CaeUzgpgzP0dFn/C9Q/d8QXQvoSudUdzLpbum97pbbwfV a92tz0iErI9Bjo7qbTqeGXKbyCeMHARjdFQfomvJ7aH6OF3LDFQYmKzDPUe/Vl8gXKb8VEL1 rajuoavrkzEj09Ax0wDrnz8AvkGgDUD0b8ACQusgWEJYPghWDcCa24PLStf1hE0fg606XNk6 ntlxm9hN2PfxcOXS9eDtwcm2c9jAMQMndLiG6lcnzY+rgPKnCWdvhZPt7Pwnw1VIKKb8JQNX CTduRrUwCKwDkP03gMaieuggoP5UF96KgWNdXXx7mDGRruMJ5R8DujejklBlyE26TUwZ3Hag g3U66Drt9jCjnq52YAmudWlIyTQaV5mgUn5W/7PSMSNs5Od+MmYkCYsG6HAPQOBWzGgjLKN8 iOLOfP06o33w9nws4oSFg2AxYekgWHEzZqzrj903xdtUvEzFsY398WXGlpvjR5+dpM9ral5S Y7Q9bWx33dymvpiSbpspH075FusybN5VN8CueT73Eg4QOghH3a013AZaX2ac0su5T7xGzOhy Yy1xU4ydcZFwhXCdQP2387pVrffXTmuVndcqmhc71bVTHTvHAc2I6TQO9jF6vLSX6HrttJ64 6b6d1g87xRQ76bKzrpnG+KbGk+ryOmnn2M86K/rHmXXZo7oOvmenWG5v1dt1yzwNmKO+9cSY J9bFa6Od4r6d5sm+Kq2+S587/mynsbdTHLeT39m3GjJSGnIGwcB1ecwgKHH3r69pa2wfpqZh 4BqbWi//M+vkAvfNa+ESd/8amLbe2U/odmmn+G8/a+TJ5uyXDJsle7NTLLff0D/XCMaVYnVN tu63Nbm6P3G/aij+1lD8rSk0/CLlB0Zc5FhaU2zEubp+H6kp1+MX1++LgQN9a4Bf9cUXw7dq jFjM9l8zRW9jX/25ur/VUP0afg49u4biX81cvd2IS9SHGtJXEzDqfVL8GRDHB5VJtXmQeNyH WWn4uGd9QjzlebgJA+NkeqxcnBYj02PieKPuQuNesR6jXXP1OXa59X666HkuknPF9XKOWU6y HRfVw/5lgS7romdgv0H7DhfHurNGPFth2KaxJ3CtJlBM4PXftcGIc5t1va5tOthHXTsJewj7 9TjsopjmOmLET4qXruNG3ZPu/j3TsbQ4uq1fB/ZSZ6jdB412DYzDA2Jw3x4mFYe3GTrOuVsd y4w6qfrn9diMz5v0MUDfLhhl69OwdRDczl7woLt/T3fM3bev68PpNAzc16X2aP+ZvVmu++b9 V4G7b99101q2z6g7tH9MUr5Vs9S4st+tdvfveQy/qiGbqNlggOyhhsa8huavhuavZr8BsoGa Izfbe81xAyd1/6qhea6heaqh8a+5PLi/cWysuUags43DRMjs9zeHLS2fZ2C4DvY9xwhCkXEd 2++DjlICxTtHZZr/UZ8dVXp7HNP1mOVw6GtPCryndNB+ztGg99lB+zaHrMcujh8OVV9TUvIO 2q85aB/moH2Yo023R8dKAu2nHLTHcWzU9wWOLYYeGj8H7Ukcu/R4zPPvoD2E44CBDn3Meewc XK+TQHsJR5ceux3dhjztIRy0h3Bc1/eAjl53X2x2Sv3rkpP2E84c/TzizNfPFE5aI520Rjpp 3+Cs0MfROVk/j/Da7azWdThd+jw7Z+p+5aQzpJPWQyetf07WTWudc4G+vuNeq+5znOd2O2le nbTmOVfpbXeS/TnX63PuZLmter+cHMPI35z79JjQF3MphjkP62ulk/zMyWem03q8c3J7Lum2 y+PFeedV3Z7ZFpw0ri5BH0f+NsanD3z6p//4Nsbf07syqVg6yP+iajosvCYIGSMIRYSxhFLC REJl2rXKuE4nOAj1hAZCI0EmqIQwIUlYRGgjLCOsJLQT1hE2GthC2E7YRdhLOEDoIBwldBrP OkXoInSnXS+mfb5CuE7oFYRMiZCVds0hDCHk6/J8zRxJGEMoIZQRKtKukwlTCdUEF2GmIT+H MJ/gI2iEKGEBoZWwhLCcsIqwhrCesImwlbCDsJuwj3CQcJhwjHBC71fmacJZ43o+7ZqSv6SP Ka6njHpy2v2rhBv4L76FO6wE8tc7cvuvPD53DCUUpF0LCcVp1/GE8v4rt/mOSYQpRv1pfxsw Z+mYroOff5O+oQNgJ9QZV/uteu6YRZirj/cdbkIg7RoixIXXnEudK5yrnWudG5ybGda4c5tz p3OPc7/zkPOI87jzpPOMNeA857zgvOy85uxxmVyZlGyuPNdw1whXkWusq9Q10VXpqnJNdzmA elcDPje6ZJfqCgNJ1yJXm2uZ84hrpTXganetc20Etri2u3a59roOuDpcR12drlNUr8vV7bro uuK67uqtlWqzanNqh9Tm146sHeMK15bUltVW1E6unVpbXeuqnVk7p3Z+ra9WI0S5Tu2C2tba JbXLa1fVrqldX7updmvtDmB37b7ag8Dh2mPAidrTwNna87WXrPHaq0a60Zfj/I06wUhWStmu 63W5VH5aT3VD6woIQ+sKKRVTGl9XXjep9mrdFEbdtDo7rQnDBv3FBcH4xYVM/OJCFn5xIRu/ uGDDLy7kmPgXF3Lxiwt5+MWFIfjFhXvwWwvDbCNsjwj32ibYqoSHbfNssvCkLWBrEp62hW0J 4RnbQttLgtO22PZ1odb2su1HwrO2N237hEW2Dtv7Qit+fWHT/8ctE8VcUcP3VfYIDwnCqBMG yNNHnTVw3sCltDyDvHvUDSN/lv/jdj1faDWQbYA8vZA8qJC8u5CECot12cLxhjyXlad9nmRc pxiY1v/MQrv+ubBOeMhppZTtzHUOdRZQKnQWI413ljsnOac4pzntzjqkWc65Trcz4Aw541S6 0LmYckupRrHhjbo/siducO6huboTv7Qh4Dc2TPiNDbOt1FYqSLanbVMFi+2LthlCBn5vI9v2 ZVsjzYPX5hfus4VszcIIW9L2ojDS1mr7mlBk22vbK4yx/dj2Y+FB20XbRaH4/7F2sfdL0hPE syw+4k8hn4V8GfJlyE9A/hHJzmxZhHyYuNTyCvJPIO9D/iHkn0GtscQlhrZaaFvIdyHfII1h trj4W0+WJOXzpEJmS4R4B2Re5bofIf/Rm9DTinK/3iqjbZXQ3Iz8NJQjb3mB2foKyj+Hknmk 57fcwo+6LDPR2kr0SK/7EGS+hNY+Cp3zkH8ceS9a/hR6J6Mu5x8x/wdKHkb+t9DwKdydhnIF mp9CeRPydyL/JGRK8PQGPOVOPOVJ5J9CXpcvh7ybeDzy45EvlSrA5dCAEvAElD+GUXrM4sdT KiDD+QnmdtQ6BMkwNG9Afj3yR5FfhvxebkPvZMhXovxR8GLiceAJmK8J0tPgx1FrPp7rBb8h iKaAZTlxpWUJ8dct9HRTFPl7wGbwScsa4jaWFO8Cr0GtUrDAbH4Jkhss3yTeafkO8QNcIp7j vPgh7q6F/GzIr0e+DJwHne9BZpT0c+J86afELqmTn8J58Zfgt1Huln5FbGdJMRM8B7VMyL/J bC6E5DyUKywv9kLD68i/ibv1uDsc8k+jbjf4L1KQyqstLHldUilvtbzDo8HlYqPlMPHvJLIc 02iWET60vEklNvD7Rgmx+fPQMxpchLoBcDv4ActncfcFHiVm04fInwD/DvyK1MBzlHEf2MRs 7QF3omQ0eDY9a6E+g5D8uvUjnkfk79EZte5BrXtQ6x7IbMfd7Sg5iZI2lPwPtgTxLs4Tm5hZ A3EnSkYj/xHsgezTNB/yC1C3FCUC8oLlLJhLxoA3oHwD+rIT+Z16Hi3ciRbuRHt2Wil6mH+B fj0AC3wA8o+iVefAH+psWcnWhbtroW0ttK2FtrXQtpZHiSyQ2mDGc836E/NQKw+9ew/a3kO/ /kLLHbHlHLgD/Bq4B3fJ18zDMI/XIXkKfAl83XIctnGNbYZLyI86wK+Be8DHeZYh/zvo/J1e wrXET6NV4zkvfMgyZFEd4NfAPcwSRQOTqNse50UbtL1v+QkzlwgfZsyC/G+5PWjJaO6RqQdt KEJJEUqK0MIitLBIv4v2F0mXqKdf1i3ZcpVtGE9pR92JaLkP/IA1CpkO8GvgHjz3UbZtljdb dMZ4/g78CrS9ghE7zJ5FEWkDrHofbFVnWCDyO3WG5rXI50E+D/OexyU0OwpGHsy9ozFU0F/4 LDM9/RzGn0u2wn4eB38RMXCY5V+I37NWEy9H+R+ZRTB5x79glv8neytKTkJyNrwgD1wGPaXM 5uXIb7CsRsuplvlR6P9vqDsZ8r9FvgT8hm7PiJyvI4q+Cy/I4HLrDbYN62YeN8t9XFfy8+hZ 3+W81c55825Y/lTY878yZ0jcX+sqqYtbC+tajHFr5vaQP9ox5uPAwzDm48DDMPLjwMMw/uPA w+CP48DDMBfjwCz/J7T/ZWjOR98DiC07wXl67LI+hEhVRlzALRE/5Lz4Fma2MuNBjmCQNyN/ ErXa9BiFlrfBf0v1OMN3zS/Br1+CzAbwA+An4dHndM74ITOd1fmJfHc2LGc2IsN6LqG1ifVP w90yPUqg7nsZz8FCyAtM48AV0q8RnVjmcygZLb0LH/wz8WT4yxUrrbymn3A5ecSfEfnJI8R5 yH+fI7ylG34hsLylDnHgA5QMQ8x5G752RwbFQ/HH8BcJs3+DZ5Mi0gew8w/g6R/Acz9gPzUY Poh8pwTfZD0mxfIH4juZScNx1NLjD0eYS+jLQm6z2W75MXGNHuuwPiroV2MG7aBML+m95phD mr/IfWf9FHlG8wqIXnzeiIfH0R7mdp2t3wJfRfRYj90Cx6IPcfeEwRwlaq1fQwx5FD7L/FTG SKzU7yJGvYuRpJVaPCidwbP+gPj5Zx4Z3P0hJO9FvhiRc5zlG5S/IE0nviz5MXccRR/Fcx9F PgP8LfT3KNhk+RP1KNOiYX1nPWXYpRRirKrwlHfARyD/c2j4uR458XQH+E88F+IYRM7ZiOc/ RX4leJ6FdpimmdBfj1kbAT3nUILIL54Ct0B+K/davCE1o48txMXSCY4nkPkuevQ+t1NcBw3r ue+WR3mULEXM5lfYJikukTbzB5yXYsjHuOVmJ2Z5GCLVn41IxXb1GdZmvp9bSKsh9zoX/fqN dJryj0g/o/x2lJSjJX8Av4g2nEK/KpCvQ92npR3EVRKv1Ks4T+sOj9VpSBaZ76b876HtQ/AW lD8FDY9JbcR/AD9jIR83SWjbfXji65DfJr3N9gadN8BtKP8TNFRA23HkX0D5IcsZtJkt/+u8 W6NdWYx4NUdyKq8i/c9ZJ5B8k8Q+5WOm/SHXehrjs8nyM/hdCyyQ+ae8ezeNsj4HfgJcDM4C Pw9+mVjf67ogWQZ2WcdyxOO8+EuDi8FZ4OfBLOOG/HJoW44SO0rmWjjGZqJuJj+duBicBX4e zPKPQXIOJN/UGXu5edAzDy1XkFeMfDE4C/w8uB5xZg6N0pPYe/dCZy+0va7rlLawhUNPPfTU Q0899NRDTz1Go561mZ9mSXMN+Hm0vBt6upF/G/m30f5R1ncwGjrrPX0HrQJbsqHzHdR9Aszl LRY68Zls4LvpTM/x8ClEOYoSphqUf5tZfBt5r6UK3s28FSUnIHk3epovbSdeyHmTidk8Dfl5 YIVrme9iptWH6+ai1pvQfxElGnuiqd4yETbMY7iCR8w6mXtqPcgs/XeuJf2Zd8iW9zlvXYxd x2MYwyTG1gT5yah7Ev5bjrOPg8+zNFbzMErzMErzMErzMFPzMEqc/yna8wLkzciPwjgrzDR6 sF5LDVspn9ypF7wWfFvaTyX5ht3qlpkFa9RtshjWlcXnNcxpIcrnQWcv+HWDeaV7PSMKeZYZ zrNG9jAWvdNZt4exkCnG3ZdR8jJaG6EYu9hM/thrN/+R2fKAIH70C37v8dEvLF8l+e/wCd18 2DKXxvNxjvDSVzhv/j74WyjfbAkRv8qSIuRp9SeW7kfdZ5itfki+xW8npLf53YW5Cxqe5fch Ug7u/gC1vsuccS/Kh0BDD3gr5OfiZLqQ5938Q47e5jPIfwE8gVkawedZaSTW5SWQ/zFm9tfM lo2QmcB5aThLmv8JUeX3yPtw90HcHcpsrYIG/QS9FTwNz3qSY6D5VX7jYZ7K66z537ArWIJz wUHet5sP8YmY9k4kIy7n8RQ3YFQXoOTrvEOwXIKefeBO8L+Cfw0958BHwTHpP1D+Au9mmS1v Ib8Q/AbOy9dwOv4B7/qkJ7H3+5GRNzHzzo24EyWjcZdWFutjGH8Fktngx60J4v3QsAz8e51Z A3EnSljD9yH5HdTq4RKpByXYeVr+GevjP2NHehDcAj6FHeYvsZM8iH3sqzhB9/KukmyJd8jd eGId+IccaS3DoHMY17UkkU/qedZD3IkS0mP5Gp+UM0zol9kyhHgG9FxAO59hf5e+Bw02g1mP DXpsGJ/voS/f4/GxPM75jIj12+A42wb0JHTGqN4B/Vu57+Yo9ni/0pn3b8Qd4NfAPZChOGZ9 CnPdCsmpFjpxWF6x3k/aPscnTfMuLpfu0Zk1EL8G7gHbuXe4ixO0+RCXmDeg7nn2SvE09skv gleDD2A/uQhn0m/gTPpV7JeWY2+Ac7p4iXeApvXQPBT5Y3xqNldaetl3UD6B9Uhnuf0S9t7S V3RG+VfQ2q+gtV9Ba5dzq6RmPjtb/zdqCdgx5qPvOHeba8G7sU/4AXq0Gifol7ETOwL9D+uM pzyMpzyMpzwM+SM8qtI3+FnWMssCcAfebHCtu3VGSQ1G4xpG7LrlXfhCBaxaZ7bPEj47k71R iVWzwDaQ96JHCfhUAvK/sryHGdGZR7iAz9GSxCWWRmkvWsj5RcjfjfbfjZJcWGM7eKYlj7Sd 47Ow5fPW5VTyDpdb1uLu08zmHyH/R5aR7sLZ+SBkOlnekgXfuR/8PM7C38Mp+DKzZRjv0yxJ rmWtxFMmQ+fPsD7+Bpq/D22tYBufuKVduPtdeFMe+DN89w68KcqchZPXf3CUtszj+JbxFmL4 VM6b/g/O5o/Bp3rgL6/qXowSKzR8yDozZ0nrqNZdWAX+wi2kkefZ+YjP0RSvhmFexoH5fL0O 5+v/xXmSHAceBk8fBx6G+RoH5rrftXIc6EIb8KZCqrPm8xqHePU2OIEYUsgncem3fPqWdjDT OsjWddj6Xdg5+/hB5HvQi1dRtwux8YdcYj3OscLqR/lb4PmID12o+yz49xmPgNt4BeQSSwZb VMa9kB8C/r/snX2YTtX6+Nfea+/9zIyxvDQkSd5DiDFekyTvhCZNEophQiODMSMJdeQtiRIS caSSpEiStyMVUkmaJJVKkojKW1Ke+a37s/e5fnG+1/d0vuf8eS7X9dn3vte91l7rXve61977 eebxDG2SUfUSedb22spzh9cHprAj3+IvILpOIlv7oDv6Pjx/reOJL5O19k1wCXuf1fs8ydo1 KM9Hb3NP9aNYeveTB8bL3X5sLuvxjMxj0InZfFw0wfW++KecPNXaCJecxrs+d4EwNlf2IL1L Vp/Ok6dsSxnFauTVrO5JItu6IaW0NqWXs7JC+R7pg1dfrmL3VvtE5jXjuewT3ucUCO0Keomd 9CR7qDwx5ctY/B2ywwbdyK4/cyewiKeYATy1/SrP6R7vHvVCeUJ3J0qGDwZJn/1j5ISNZNc+ eOBjkd0DcAelNwXFYI5cUaLIzsUB2ZEpHQOPkWdepxZvQfXF8sxuM9IKer5CslxgY94rylzU hn2ZtdGe5Nu3YSFj/5bZKY8NT/d6BpwMb0SfwRNcgYzUa4+mMnID7wPal+c+/OZ8hjeS8cZl PImPl6d4717vB9vD/tTqKPdX/iGi5S3vNnKRjHcddddRtyPRUg7PH4GT6M9a5u5Snh8fZsZf Z5dZwlw3R/OSPEd4PI16G7FvQ2uvCP2PkFeR2wPkMTxThy00hQ/IM773BWv5Irlr9bpKP33f nycZg37OJVrWcq84Vm+x+gPiyeBjiVK7EwknCL1vPJmXZ8jz94rsf+/LXv8qu9WX2AwgE54l T/altKRQPyG7pD9FehjcgAe+oLd75KnfKyJP/Xo4T9BH6VVnRn0542otvfLfxQO3oF8po9Cb PfvU4M2XT9y8efpT+mDl4BPa3419f2a5v7wHsHEuV/wQfWXkJyMbaXOqvAcIlNBbKG8DvHTR B/n0YQb25eRtgPsT7feG6ei/poWuIvuPIVcNr8LbudqsSvbH4DN8tRZyJ6yXwtEwXI+luI/d gD+195mVa8qupN/Ce7N5/1mSq3SCLfDYdjLDObLZGfwzGbYlxurwrLQWNozkq2FNmARvpdQ+ +/gPcw//A5YPwVf9Jbb9psi14bSINWESlBbaYlmeJ82xovHGoimN5hhPuFN4xlwIb4U7eZan P+5zPPE9yruFk/J0ZteareU+i+VJrnuf3PF6i2hzkdT1HkQ+GPFqWBMmQenJz/JOwD759rae rM0YX5NPtPV3tFkT3gHfkCdfrzqtTY54NawJkyi9FVqPeR9Iy8Em+dTP8lnbwpvUqhJRvLSS ltuJN6yfu+Ax4SOMvby8T7CjsBr/C3nbYK8i8ufIVbh6FdF4y+lbM6E+4dnnaz3U+5usC38q mU1Kz1B6Cg5Cc588Wevl8C7R+K2wH4lvL4cnhTYzvCy7M/IieFBq+eeE3m7azBS9nkjLFeAP 5IfJ3irLHpQ2wMML4QyxSagmHkjAD/4jPG+eYPfcLXJsCHvockofxsNj8d418EFibBYtVJM2 E1bKHVHwKE+j67x1tnRkFNv2OVq/FMVnJs9QEjkTRbbtZDLjmXhY5AbydsLL5ypPSTv2vrGO RAJxWxZWoT8LuFY/v4RlqlB3xp9jmNN98C7sx2JfCTmf2b9ZNEEViRB/Mfr6sAz9nCyye5QW Hgp6wuMyd9jcJ7MftKJ0A5pmtLkMzY30PB+fvyH6YFNQlD4XxRvy7Yv6hXYXULrwHeQX5fsD MLXwOeQacJJ8GyEqfR7yXYLCUcghy8AZ6MO6y5GX09oy+AWaL5D3YGP1bnahvPNsDh+EefBi qOEeOEHolBCqOJpUqIR6LPIiuApWDOW4vK8+QN3f0MyDvai1EDkNpmDzPXJlWA6mo/8QbkWT BTujSaA/R9G4aDbQchU0mXAw+rDPg+nPa8gZsCz2rbE5CH9F3wn5DHKAXAt+G5d8WJXrMiLH iMY5QjvXYV8NVkU/B5uwJ6H9bjgbTXa8kcRq6H+R3YvhHvjX0OfI/UKfIyu4CK6Ky1r+IPS5 aJyZ8DdK59H+qnBcyJcgr6RUw7rhWJCdcCy0UCwahei/DscVf9+2cDstZKFvHI4O+9R4Bavp G89gFBn0PIMeZtATYQr6X5ErCu11M2g5g2sJm3Ct9vjzUto/ActylTBOiBk9DdZgXA2o9Qhs Ebf3J07Y5zrwdVgcxoSxMsJgptB7HzaRsQdPo08QWa+JYrgRkdlfPoENIzMun1udQp4Rr2Ll 0/GGzOZB5vEg/hfeG87yub2yyhhd8/hQWWXIeaF8bjtyEfwmnEDphPhNsAieFH1X9KnUUsgq kovIGkSzKOJQKLVuQnOTaJwD+P+3iENhEWanDRS5l5Tqhdh8H1FauwrPn2RE14RrJy5vwFqg Px5Fi/WM+2YYFed+s3I+EbVCNP5ZbNaKxi/DOmp/ju8t4OHZ8eJytx9vLOv0nNyrE4HOfPGt sxrNGKFtWZ6eyAC6C+2fwdtzsJxNZFamzV/PyScCdeKy13RiFAHeCEIZz5dl1EWhhlXj7WER 4lM0ifjhiNRS+E1fF0Ws+PB2OAeb+2EmmvyoNfHtpcih52dHFJu34nZPcQ0jfRX/hDFfk/4f xic/Rb5tYmXi3FLeohPJzmNwB3QZ+2bxoe1hEyga8qFuRTsfwfdojfzvfCo26hiRXDle2bIr +jno3xaNOoS+GExmFh6P1r7MV3farBBmSLgXHo7/zkgbQ/m8hh3EeQMuQx9GRZgn02n5CD15 Cn1diTGP+PEOiL1frdD6RIf580Ppj/5RfOjlI+cz0hspDXPdL2EekPFaSm8vwuZy9CWx+QK5 HvLLUT60vXUaovkZhjmEcblNYTfI3uGGviWfOJ9DdiVnKfrrYSNIa27HuL1Tcskn+jIsl0P2 WXcX7AMnoZ+OZdiHdWhmwN/hO9HeJLMzK+yzyN6LyKOpNRQOCnc3oiIgxmrBgLoHkHdT2gB5 RRQDIkM33IUroPkQTXN4B9dKQL8XbkDP7mB33p22/2R1J07pvegzotWaQWsZtJBB3sigVDQH kcNduxQM7zcG0tq7MNwThyFz5+CsxWPtsPyCPaJEOOOyO7jlkXOw/BJ+ReYfALnn8e6C7K0+ ng+4U9LhPA5mFFsLs1jdrcU/4ayF+mhcsiOkk502wGuxqXzuEPtIBhxKVhe5Ddn+W/ghGaMz +s7xa2ER/FME/4u+JjlkA17aEMmyF1xFaWbEofS2CKtJbF6LfNsGiv4OWJbM34XWtkaUutfD bD4ZOcEnIE/ytvbJmOz4dZHrBkds3XrIV3AP/BzfHerEJ5VN/UIZF+9zvhXZ/RT5bzyzh9/u iPMdjMp8frqVp87ufMbaPbhZcgL6IyK7oXzCby05jc9eL5GnA5XqNrXyFF/eXKV5A+UZ33va crvI7k5Pvk+yUqiPe/I8WCCW6qDQGUCtdkJ/o9ALYB1P3gq2o7V02lnCu5HmtPO72ATdqJse Xlfo7oWtvLKWZ/S90N516yzkPPTdhTpH7xO9yGqX0KlF6V6hn4LNeLhMP2zp0kIrz2Esoh8F ac2fFV4R7oPj4Eotb1NrCt2ZyBX8HlY+ILJzUr5RbHtonwh0smjUNm2fHNXnQne96NU2sffb ULd02ILo3QS9TtaUXi3ZXi9CL7WOSamfhM0SeAx9NaHVSwtpQn8hvToDm8Jx0o7bPeqztXc8 obdHqNPhMnqoXUcob3WUi+y6rmicjZTynOXs51vTP0gMu1MkX7kTZVyufKb8lMjOCVe+p7fb lXfLU90xlhNcm5+dEmLvzIJzoRbqsbSwyJ1sucqVCK+o5dtHLfRkyaKicX7DZh5X7EWthchp MMVNsDbfY1PZlWgv514kM+vKp43tRHa2wmXyfzi6nd0kWFoyABwGp0Mj1FVoIVNkd7BbXtaU a2PVHSKyW9L9QtY++g1YZmBZlrqtHbkTc2ntoPOC3Ds51aymqnPYygWOXd1uCUe+eahFdmq5 demhHYs666XIjimljg+nuA1F466xLXekblVYLZL3WsaE6hStzYF1ab+q8w0+tP5xf3NGy7yg +ZaWZ2MTE6pjUkv9Ij1xP1WKv3GoJwx6CeX781bzMvI7yKeQByI/biPq02Cx5WjYTOgXEerv 4DI0l8BkoVsJPov9Hdj0FQZxbFrDgZS2RL4P+X4st8HT6JugXyeMtUAeAKtj8xFyW9gYzbvI M5Afgd3RzKM/xWF4XR/5d3rVDs1WuJda55D3wapohsB70TBerwF1pyB7lL4PT6DpiHwrcoxr TRI6vyCH3vuEFh7A5gb0e9DXQ96C/A5+wBv6Rbgd1qHWp7Fs+dwhnBeR/SLwsnB2kC+ByfD6 cHZE9t4J50hk3RcOhXm0NiacKWpVDOcLeVg4U1hug6fRNxHGWtBydfQf0bf62DMW7+HQM9j0 QdahT0TjDqc/5eh5WHoW9sBLG5FzsCkBD1FrN/bhPJaHF9Nb5trHS34YA2HPH4Nhrz6j52EM /4zlcPq2lvazYBhv/YhA+hYMwpJr6Q/gZmx6wv5ojiAbYcI+aTOBSA5qUHcwrWET64o+jZ7U CNcL3jtCrbexSUF/kLqVkWlN/4DcBvlB5CTkMKJG084yZiHOuFrCdXAAfBTL26m1GpkICe5m 7OF6PMB1JyI3RX8US7wRuwfZpVYGcm4Y21z9+dDP8HLqLkZmvly8F8yHC9CEuWJGuF5ooR6z vAWWoM+dsMmErCm/CjLz4nWBjWjhZuTesAM2BfArSu+Cof4KSA5xWcveC7A97b8Bn4NzsCEf ugupdZgYPoaGuXAZi7cCsma967BcBT+Gy2mtNvIpbLrBXmjIsQH2Abkodhv25FUvQOYqAXnV OwlZI/pHZEbk56Mhf3pYajzsEoF6PzKrzH8VmyUwzGmT0YeZ9nXIPOrQqxMgWdH/Bnk2TKRX V2NJFGnWhaaHmt3BG0GtMBK+RI8fYmQAPx39evSsQX0NZO0HL9HnbEjkeIzCY2Y9vOqGowjn l90hINN64XxR1yMz6PBaa+AuGEZRmGHCTBjuRw/RN/YUL9zXiApdFLkUZKUEYWZuS/Q+QtwW J273ssZpx2NV+vhZv08pGd67EoZ5gPn1iWc9i/6MpP3pkEjQo2C4O3+N/Cuk5QSyawJ99l+h FisuFua0peiZnYBS703qkhv1EOmVUoVNYRn4ouw4cfl0bzRsJvSLCPV3cBmaS2Cy0K0En8X+ Dmz6CoM4Nq3hQEpbIt+HfD+W2+Bp9E3QrxPGWiAPgNWx+Qi5LWyM5l3kGciPwO5o5tGf4jC8 ro/8O71qh2Yr3Eutc8j7YFU0Q+C9aBiv14C6U5A9St+HJ9B0RL4VOca1JgmdX5BD731CCw9g cwP6PejrIW9Bfgc/4A39ItwO61A3jdLL4PW0g70eCvPQjKG0IhxGrfroad97GPaBmusOh+Vo IdSfhT2ouxE5B5sS8BDcjX3oz/LwYq6Iz31664dzQR+8x2DYk88oDWPpZ2T64K2l5SwYzns/ IoG+BYOw5Fr6A7gZm56wP5ojyEaYwGwmEFFBDeoOpjVsYl3RoE94G00KdQ+ir4xMXf0Dchvk B5GTkMN5fBTejmY1MvMS3M0owgg/QJsTkZuiP4ol44rdg+xSKwM5F8vnkS/HfjEy3nYZezAf LkATrjhWgdcJORMSgX4VZLzndYGNqHUzcm/YAZsC+BWld8FQfwVkxblEvvcCbE/7b8Dn4Bxs yB7uQmodFjrH0OBDlz57KyAR7l2H5Sr4MVxOa7WRT2HTDfZCQ0YKsA9YubHbsCcLeQEyVwnI Qt5JSCTrH5EZkZ+PhmzjYanxpEuc6P3IrAX/VWyWwDADTEYf5qXXIVGtQ69OgOQQ/xvk2TCR Xl2NJRGiiV5NDzW51BtBrXDGv0SPH2KsET8d/Xr0rBR9DWSFBi/R52xIhHiMwmNmPbzqhqMI 55dcGpCXvHC+qOuxfnV4rTVwFwyjKMwDYbYJs/dD9I0M7IW7AFGhiyKXgqyCIMwMoX3oSXKd dyVkPXrMnU+s6llcayR1p0NmWY+C4T71NfKvkDYTyGwJ9Md/hVqsmliYVZaix/MBpd6b1CU7 qQ+0VvJOTL67UsVP4m2M/H13O94IZWn51HsR75HaU/qU7yt5g5RiOYc3aa5o3O/RTxO9F4il 3YR8eXOCvqfQ3yX06qA/SQs5lB4SBsOQs2A72jwWWnL1KfK38DpZ3pi5T6F5MHrfJW//TvH2 rANv0s6Gb8zQLJZa7k40LvbH4BLGmCx0xzHSbrwT28LbqjTkNP2a1BIbVSh656LoLZml+pp3 Yqm0k06tVry5aioa5yJvnpJ3Zctk1VD6FOwujOcUyl/mdi2UbwqtL5Q3k93lDYa7U2SnFnIP Slshb0Deg+VokZ04LVSj9E1q7UYuGbaGZn98ERqpWxf2RR8XS+csmiewr0LdZyhtiFyT0gD5 TuSJWDbl6p9ieZjSkSLH06U/XqdwFEq+73pGZF2Ma1VCzlG8WUXjodmO/V5h4CmJDXqia2JT BtmF+7BMQE5G7iy0MSTyEq64Enkm8hIsS8NFvB06iJyFTR51e8gV9eqoz1I6iuu+Rz/3IJ+M rijRWBe5J/Z94+vkzZvo1a64vMVtR5uzKB1H3UTxv814vBdFM50Zyab9TvHn6IPY9xHZ3SI9 17VEtjHdSHZDarUWja0735bOj6+2viJCnDVxeTu6XEpt7nqO8cqIatLCfpXEO/zV5ED5O81K 4VXkWxC2t9LzpejL4PlSjHGntOmPpH0Tf9zarMJmelwi/1LaNJRuhvWkV87c0HsyOmcCTBV7 t1p8E9fdLrMjsrseuRpMgHWF9lrrkTdxrQUSh1xxvEqRtSPXdderYvJmEo8d44rp6A/ALczy Qmoto29fwRZEF7Hk90MTF3u9r1A+TShX+IPlCdrMDq8Szhfr60y0ysQzU5BjQvntL5tdiSJv EmwpMRA0lFL/E+mD37XwLHOxAi5jJUrdS8OeiGw9I746Vfg9d0czWaFcF1+Vk7lzJtC3Vmjy ZO7cKfhtCXLTeHPxTzwLmyxKxzOK8dL+uR/RHOJzN2khGbYSjVtDPtnxGuPhY2i2xEdJ9MpY nMPMxVfYJ8CqcfkVAp/Pg+ZJ33RK/GmulcOKKJDPCOitooeXxeVToaxC+SZAAmN8mVEnSlw5 HYjVLPGA93I4X3J1Z00YXWIZEGN2dJvY2cWHVcgz+8O8IWvQjk58eFJKg+VyFaeANjvRq+74 syR167IWSorePrXxiYPQT5Ie6i6sze4yX+qseMD6ZBmzcAOWMqLO8U/g11yxJpEs7dwbf4S6 4vNh4hPLF6m7j7qHiHCJ87LiE6dMnM9xKL0tfgpZPovx8PlmbJZjvzgkPpnL95dmU/o4LTRh RJO5VpPoOx6buLOSdlaG33ei/Uz6nIDPb2FGlgid6fjnPZVufVKc/FAXzTih2ibesB6bRh57 XNYaOaeFtGPn6Df65rP7CN/D/ph40l8IU5m7smSnO8TeelsiIeAqe/H5TPKbJ/FvcxrZjPnt TraZIBrFd8nU53AVvlrOqqxGHE7Dfn1Yi6v0oz+HGW/zKAM3w7dylQ3EzPRwFLSTIHq7Q/l8 U0VWcRu5bvCo/IKTjXD5O7u3VXN5BuQqB1jdOURaFdpfJte1Ef4b8VmMrJXCXpPCrsTOQvwb 4sQjC/XG/jTZbBo92atSyXtT6bPIc+yOZOMcb5QhVl1pX/fE/2vC7BRlxTbswo3IYI3Zr6X9 eViexBt30cL4aBRWDsJ8Pj1ca9HuJn9jOM59F1l2hG34qiEjLYh/QJbezupbhx/kL1u7Cf2f +E7aalqYSYRno2mODydJa3Ytr8BvMteH4DTiajT64qy7cUTFKJHVL+xoO9CMxr4gWtHL2LPC nJ8qWYV4SBafq88ZV+9w9tmvF4el5NXdrI4yZNFxMBtNnP2xNHcRTdlTNqIh5/tLiZBUPDmK T/PziOFy7AjcrcW4n7E7OPcVXKuM+EoXRNFeQPZYTQ5UjCLM5AXkAWFvbDbF5yr5jD6HXkme uYkWOmOzhBgegKYa9u9FzGFecoj2Akaaw+hWswsvos9WE/+1cD+RkM5477aWz4c7JrWGRXdl 4Z2bxOHb1B2nylt5E2NcS/+/FMbrSWuFp+W3sCz7WpuhvN87xBs53oIm8NmTShIby758Wica RQu3+fLd1B7BKfmdNOQk5HrI9ZDTgr1oFqIpQJ4o32sNliEXIJ+jtKjIsQbyC2lo0uzsSQsf Y+Px22ifCIMz0oeYtJMStBbGZskvpMlf88UXxJbIL6SJfG6DyPEHgrnyC2mxH+WT5djF8Ay/ hPattB/K8usWVv4VPb9+FnseuSXyAPmdNH+r/E5aOMbggNgnlBQ5loTl7/S2Pu30waYspe0Y V2P4K6OeRul65DPoq6HZAeVvpVMTKtJmM64+iM/EC5BdbP5CyyvwUgFXdLn6ZOTXqNtUvo0c UvpvffiV6BMMclNaCPWp9OEO5CbId9LC19gXoz+Q/qSG/Qlm0p/N8stmjLpRNOr6tNwHm9uw n4zcGMaodS0yv0EXuwuZ8ca6MAq5SpqiJ/zqWv3Ap7Q7ssdVjuKTiWjqU2pnJ34VrB/TcCo2 38KPsCxEX48+r6XPzB3fHtTnjiE3ghlylXNbpA/nPkD+UhjvC3ugOSSW51aJhyP9CFgElqKd Usj3wkbUWkutb5C3osc/5xZwrdfRvyty3KUFZjzqw3Fs9lGrYvgpukpyJiUcVjrznmHZKuXO Yf3vUmOy++TerVbKDnRTessKyubFwkJVSiWrQJVTlVVJVUc1sP5toTqoW1Qv28aN6l51v8pU A9UQNUJNjOyLqpi6TFVRF6mrVEPbynWqo+queturpqvR6gHVTw1SOSpPTeL/rw3rGJVgM05V m9Hr2n3tatVSdVK3qtuVq25S96m/qP7qLjVU5avJqrTS7bt2bac6pHe5oYLq2y29YwU1h1Yu 5veoL7c5vZptsZ69E7hetVU3qB7qDqXtDt9NjVHjVZbKVsPUSDWFOomqgrrCtpmqrlGtVGd1 pXoIfRlV3Pqhoiqrqtt266vG9q6gtWqnuqjbVB/b71rqZjVWPajuVIPVcHWP3cfDHpRQRVQl damqYVtIU9fanbq96qp6qr52L6mtMtQ4NUENsFk4V42S38nOTB2eqTNgb5gF74Z5cExmn+xc PQFOh3PhYrgcrsnsM7y/3gy3wR2wAO6FX2VmDs7RB+FJoefC4rA8rAWb9sseeKfXBnaC6f3u HjLY6w57w35wEMyBeXB01rA+md4DcCqcBRfCpXAV3Ggb7uNtgztgAdybffeIwd5X8CD8AR6H Z2Bc6HvZQzKz/SRYHJaB5W3hML8KrAnrwoawGWwJ2w2RdjrDbrAHvANmwWw4bMiwfnf7I+EY OD5H9FPgdDgLzoOL4BK4fLidI38VXAs3w21wB9w9fODdWf7ncD88BI/Bk/Ds8MGZOYGCSTAF lofVYerw4XXrBc1gK9gJdoM9YT/L1CAb5sLRcDycCmda1g/mwcVwGVwF18O3LNOC9+AuuAfu gwfg4eEj+g4PfoKn4e/CmAsToBk+Imd4LAWWhRVgNVgLpuZaT8Yaw+awFewAu8IMKG9uXJt7 Uv6Fo7br/FJV7v8kOfzI9v9OX8l7r8DmxYT/2JnHWSg76vJ/YNE/SW3zXBF+z//fkRybvf9n lvzTdJkR17YqZ060TwmT/jRL/Gle9g8s/qdZgZ5qjs4fKCP4o878U2q7U5VWZf5F6WIk1+5P lf6lY2V+/vnPH6uqav/C0bE76T/nP/eJY3fwf85if4r17N1Grt31Z6rFapV6SxWoA+qk4zkp ThUnzWnldHP6ObnOeGems9hZ5bzlFDgHnJOu55Z3O7mj3CnuXHepu9bd7u51D7tndZIuq2vq prqD7qEH6VF6ip6rl9o1KNdKCGNWd77gvO8F51MvOJ/2h3PvgvLALvM9Kub84Twp7fzz5EXn 1zenz28/pcf556XU+e2XSrngvNoF9u0uOO95wfkF4ym19/zz0tUvOO96wfnI8/tfbuH55Zet P/+8aq0Lzuv84dyuv6p1Lyh/gHPX5oeS4Qiv6Boeq4cj92zMlba5qlqk3Rkd90bHA9Hxp//J uubK6Lg+Om6JjrvO78WV5vxRXrn2/POrHjjf/qrPzz+v997556mrLzhfc/55/W4XnGdccJ5z wfmwC85n/SHKrNBwzgXna8+3b3jBLP1D+Y4LzndecL7r/FlsssPSWM9kOo+rLGce2bav/afs Sp0p38jwS7BXlFRBcnuzJbmdectsMputJnCOOket3U/OT8pxjjvHleucck4pba4z1ynPXG+u t/umxIOrW+t2cj23pFvKauy1tZH+6KK2Zh17Xto+jQxT89QW9ZU666TYPiTYXqUk36jc5HbJ 6Zbtk2+y7GB7X9zm5Ar2aaGufeZpZg4p7Ra3ffqe4xZjn7TcUvb8CMctZrdy7dkeyy1mr+U2 5RGhZVUl85Xt6yZb+jXHLWa/PW62599w3PIHywOR5beR5cHI8rvI8u/97Uh/O9HfG+jv30s6 U9KFkq5/LDHb6eF79HAHPfx7yU5KdlFSQImrYq79Z5dZEVf+yqS4W9x6tZT1qk5uk9zWen2T 2aQC26fN1lP2KduVz6TDXd8uLVu/D/OlmCnHOeuctbNW6BRab/muve+hXZ92A9qNuWXdsirB reRWUoludbe6StLtdXtVxO/r91XJfj+/nyrqZ/lZyvgD/AGqmD/MH6aK+7l+rirh5/l5qqSp YCqoi0wlU8mOqYqpokqZaqaaKm2qG/vMZ2qamqqMqWVqqUtMHVNHlTV1TV3+z4f6qpxpYBqo y0wj00iVN01ME3W5udpcrSqYa8w1qqK51lxrZ0firTLxVsW0NW1VVdPL9FLVTKbJVFeY/qa/ qm7uNHeqGibbZKua5m5zt00UOSZH1TK5JlfVNnkmT9UxI81IdZUZY8aoumacGafqmfFmvEo1 E81EVd9MNpNVmplqpqoGZpqZphqaGWaGamQeM4+pxuZx87hqYmab2aqpecI8oa42T5onbXzO N/PVNWaBWaCam7+av6przdPmadXCPGOeUdeZ58xzqqV53jyvrjcvmBdUK/OieVG1Ni+bl1Ub s9KsVG3NKrNKtTOrzWrV3qwxa1QHs9asVR3NBrNBdWK+b2C+O9tYeUt1sbGyRXU122y03Gi2 2+hKN+/Z6LrJ7LDR1c3stFF1s9lloyrDFNiousXstmuku9lj18itZq9dIz3MPrNP3cb/t9DT /Gh+VL3Mz+Zn1ducMCfU7eaUOWWf8131gF0fD9hIKuYUU2Odss5lahz/6/Z4p4fTUz3oZDuD 1ST+p+0pzlAnVz3kTHGmqEecOc4Tarrzs/OzetQ57ZxWjzm/Ob+pmZJk1ONu4AZqlpvsJqvZ bgm3hJrjlnZLqyfcS91L1Vy3sltZPenWcGuoeW5dt6ua7+a6I9RGN9/NV5vsfcQo9YZ7nztG bXbHu+PVW+5Ed6J6253pzlRb3NnubLXVXex+orbpojb//K7TdJqK65a6lSqUmHZcPV/Pd7SX 6/3V8fxMP9NJ9fv7/Z36/p3+nU6aP9Af6DTwh/vDnYb+CH+E08jP9/Odxv5HwSSnSdJNSX2c H5MmFnGceHLx5NbuPcm3JT/lvlS0X9FB7omiY4tOdc8a1yToBFPRVNTFTGVTWRc3VU1VXcJc Ya7QJU0NU0NfZK40V+oUU9vU1qXMVeYqXdrUM/X0xSbNpOkypqFpqC8xjU1jXdY0NU31paaZ aabLmeamub7MtDAtdHnT0rTUl5tWppWuYNqZdrqi6W1660qmn+mnK5ssk6WrmAFmgK5qBpvB upoZYoboK8xQM1RXNyPMCF3D5Jt8XdPcY+7RV5qxZqyuZe439+va5kHzoK5jJplJ+iozxUzR dc3D5mFdzzxiHtGp5lHzqK5vZpqZOs3MMrN0AzPHzNENzVwzVzcy88w83dg8ZZ7STcxCs1A3 NYvMIn21WWwW62bmWfOsvsYsMUt0c7PULNXXmmVmmW5hlpvl+jqzwqzQLc0r5hV9vXnVvKpb mdfMa7q1ed28rtuYdWadbms2mo26nXnDvKHbmzfNm7qDedu8rTuarWar7mTeMe/oG8y75l3d 2bxv3tddzAfmA93VfGg+1Deaj8xHOt18bD7WN5lPzCe6m/nUfKpvNp+Zz3SG+dJ8qW8xR81R 3d38ZH7St5rj5rjuYU6ak/o2c9r8ontGz1Jy55NGrq1hw9l3ejm9rLq/01853mvea8oNzgXn lE5ontDcrp7/ZuP/ZuP/TDb+/9FXluirKXdbzsDgs//G2H9j7D8UY44/yN7PF3cquWm6jddd lVNNVUvVQaWrHvZ5YZC9fx9l7wemqEfVXLVILVUr1Vq1WW1Xu9RetV8dVsftnb1yAic5caTS icMTcxPv4TgicRTHvMR7OeYn3mePuVYawzE3cSzHEYnjOOYl3s8xP/Ev9jjC2o3nmJv4IMcR iRM45iVO5JifONke86zdFI65iQ9xHJE4lWNe4sMc8xMfscd8azedY27iDI4jEh/lmJf4GMf8 xNHKtaUPWI5InGSZlzjNMv/f8MjjjHx44qzIM7Mjz8yJPPNE5Jm5kWeejDwyL/LI/MgjCyKP LIw88tfII4sijzwdeeSZyCPPRh55LvLIksgjz0ceeSHyyLLIIy9GHlkeeeSlyCMz7fiHJz6F RxbjkaX/pkdWRB5ZGXnklcgjqyKPvBp55LXII2uiWHk98szayDPrIs+sjzyzIfLMxsgjf4s8 8kbkkc2RR96MPPJW5JG3I49sjTyyLfLIO5FHtkceeTfyyMt4ZDWRsgmPbPk3PfJ+5JEdkUc+ iDyyM/LIh5FHPoo8UhB55OPII7sjj3wSeeTTyCN7I498FsXK55Fnvog8sy/yzJeRZ76KPPN1 5JFvIo8ciDzybeSRg5FHvos88h4e2YVH9hAp+/9Nj3wfeeRw5JEjkUd+iDxyNPLIj5FHfoo8 8nPkkeORR05EHjkVeeR05JFfIo+ciTzya+SR3yKP/B555FzkkXgUK4WhZ5JU6JkkJ/RMkht6 JklHnjmER47hkZN45KxEivwfwNJv3qZ1VzWcXe4C3Ul30Vn6Tj1I36WH6xE6X9+j79OT9GQ9 RT+kp+qH7bPLfv2NPqC/1Qf1d/qQ/l4f1kf0D/qoPqZ/1D/pn/VxfUKf1KeKNpT/o8/Z6ey0 F3hK/jZfd9Qdlas7685K6366v/L0AD1QBXqYHqYSdK7OVYk6T+fZO4GReqQqokfr0SpZj9F/ UUX1k/pJdZFeq99XKUUbFG3AW4ay/4+97wCrItnWraru3rXpRBQQEUFQQVA3iAqiGDFnMY4R RMUEKuaAYB7jmMUAomLCHHBUBIyYw5gQFXNOoKKIwFtdooMzzpt559458+79jvVZqzrs2r1q Vf3rX1W1GyTydnwp3p534EvzjrwTX4Yvy5fTNIMnesdm1zGyLjI34crmgwZod8AnyxXeYVvk Drci16AluQFwN+IteO2Nvs68M5IKv9eCL8Zb8la8NV+ct+FL8LZwx6/fS5ATMubNeHNe4HU8 5fW8ES/yEi/zCq/yxrwJr8138aBbODyC9hnC1+R9kczX4esgFa5VRdZcHLeei+e2cke4o9wx 7jiXyp3gTnKnuNPcme+1uDZbxq3l1kKN6zhtv9UmbhO09xYOcBRa7jB8313u2dfa18Jdm+Dq Pm4/d4BL5A5ySVwyl8Id4g5/z8as9jguDmpfz2lvC4nn4qH2rRygMzzhGahd00OrvSKy+G6t 39GDtdndwjbTPvcXexf7nNYb4HPCILILTUST0GQ0BU1F09B0GNcz0Ez2l6vnoLnoJxjl89EC tBAtQovRErQUxvwytBytQCtRNIpBqwABVqM1aC2KQ+vQerQB8GATikeb0Ra0FW1D2wEddqJd aDfagxLQXvQzYMV+dAAlooMoCSWjFECOw+gIOoqOoeMoFZ0AHDmFTqMz6Cw6h86jC4Aqv6BL 6DK6gq6iaygNMCYd3UA30S2UgW6jO4A499B99AA9RI/QY/QE8OcZeo5eoJfoFXqNMgGN3qC3 6B3KRu/RB5SDPqJc9AnloXxUAB0ak9akDWlL/Ek70p50IB1JJ9KZ/EC6kK6kG+lOepCeJIAE kl4kiPQmfUhfEkz6kf5kABlIBpEQEkoGkxhyjaSR6ySd3CA3yS2SQW6TO+QuuUfukwfkIXlE HpMn5Cl5Rp5zInlBXnISeUVek0ySRd6Qt+QdySbvyQeSQz6SXPKJ5JF8UgAQpP0Wg+N4TuB0 HOX0nBHXmmvDteX8uS5cV64H15MbyA3mJnGTuSncVG4+t5Rbzm3jtnM7uV3cXu5n7ix3jjvP XeAucr9wl7jL3BXuKneNS+Ouc+ncDe4md4vL4G5zd3gfvob2N8H5S/xl/gp/lb/Gp/HX+XT+ Bn+Tv8Vn8Lf5O/xd/h5/n3/AP+Qf8Y/5J/xT/hn/nH/Bv+Rf8a/5TD6Lf8O/5d/x2fx7/gOf w3/kc/lPfB6fzxcIimBG69C6tB6tT/1oA9qQNqKNaRPalDajzWkL2pK2oq1pG9qW+tN2tD3t QDvSTrQz/YF2oV1pN9qd9qA9aQANhBQEqQ+kYNqP9qcD6EA6iIbQUDqYDqFDaRgdRofTEXQk HUVHQxpLx9HxNJxOoBE0kk6kk+hkOoVOpdPodPojnUFn0ll0Np1D59Kf6Dw6ny6gC+kiupgu oUtpFF1Gl9MVdCWNpjF0FY2lq+kauonG0810C91Kt9HtdAfdSXfR3XSP9nfF6c90H91PD9BE epAm0WSaQg/Rw/QIPUqP0eM0lZ6gJ+kpepqeoWfpOXqeXqAX6S/0Er1Mr9Cr9BpNo9dpOr1B b9JbNIPepnfoXXqP3qcP6EP6iD6mT+hT+ow+py/oS/qKvqaZNIt+oDn0I82ln2gezacFeqTH dC2No+voerqBbqRv6Fv6jmbT9+JIcZQ4WhwjjhXHiePFcHGCGCFGihPFSeJkcYo0RhorjZPG S+HSBClCipQmSpOkKdJUaZo0XfpRmiHNlGZJs6U50lwpSlomLZdWSCulaClGWiXFSqulNdJa KU5aJ62XNkgbpU3SZmmLtFXaJm2Xdkg7pV3SbilJSpZSpEPSYemIdFQ6Jp2UTklnpLPSOem8 dEG6KP0iXZIuS1eka9Id6Z70QHokPZGeSa+kTOmN9FZ6J2VL76UPUo70UcqVPkn5UoGMZCwT mZN5WZB18j35vvxAfig/kh/LT+Sn8jP5ufxCfim/kl/LmXKW/EZ+K7+Ts+X38gc5R/4o58qf 5Dw5Xy5QkIIVonAKrwiKTqGKXjFSREVSZEVRVMVYMVFMFTPFXLFQiimWipVirRRXbJQSiq1S UrFTSin2ioNSWnFUnJQySlllmbJcWaGsVKKVGGWVEqusVtYoa5U4ZZ2ynq0+sxlZNjMaTqIJ ICib71zFNQH/fplrDv79KteZ+wGlcd247iid+dCbXCgXim6Bx4tAGdw8bh66xy3hlqD7zLM/ YH7rIfNbj5jfesz81hNuD5eAnjIP8Zz35qtjxOZNiSAKIjYIJoIJdmczox66O7qH+DE1UE/8 ks2SvhGnissIEdeKScRKPCF+IB5srjSAzZLGgbfPQkbADkqDz28BDCgKPMBBQGf4CmkyIuoJ VopnJW2NxgRZIlvpOBxflVIhT5NOQJ4unf5671UopSA9cAlrZAcMoPzn1SMpTTsvpUN+SroJ +RkpA/Jz0gvtk2oxrUbVUqtRtdJqZHXlsVq/rNEYwdFRVYT8uCp9c8WYXTFhV0y/uWLNrhRn V2zYFYKMwGoGsJ0X0faZ+xAfREgD0gBxpDFpjHjSkrREgjhfnI90YoKYgKj4WnwN9RFhPbnw N/nYbz3s/27/+u/xsJoP/at+8+/0mWa0F+1N+9Ix4IE0z+kHPrMZ82atwTPNZn6yI/hIzTt+ 9o1Bf9Erjv0Tf/h7b7gU/OCvHrCod/n/zRt+9XbgF5eA/y7qFesA+9C4x2fmofGOVsA8cgp5 Ry6wjk7AOFYyzhENjOMj9Nr20FO7a/3yi+8kA7/1m7KJbCqbyeayhVxMtpStZGu5uGwjl5Bt 5ZKynVxKtpcd5NKyo+wkl5HLyuVkZ9lFLv9dbzv5+/5WNVJFVfpLXjf+935XNVZNVNPfed/j Uqp0gvng09/1wlfBD6dJ6dJNKeOLP1YtVSvmk1/8oVfO+71fVq3V4qrNv+Sdv/HNct6/wTu3 wAQXg1DWBjsjC9wK+yNHtlLqjLvhIOSK++A+qDIOxsHIE/fHA1EVHIJHIy88Fi9E9XEUXoG6 4d34HAogQ0gYGkeGk3FoAgknEWgamUimohlkOpmF5pI5ZB5ayNY8l5JFBNCexfgrOZkzQ9Gc BWeB4jhLrjxax7lxldABzp2rj5KZx7/EPP5lFr1d4WP5c+ipYCqYYmshW8jGxYUPwgdsI3wU PuISOmgubKubrpuFS+rm6Obj0rqFuiW4nC5KtwK76qJ1G3ElXbxuF/bR7dEdw/V1qbrzuJ3u iu4K7qZL06Xj7rqbugwcANwgDwfpCoAbRNKq1AfvpTVpLXxQ76Ivj1P0bvpK+LDeXe+Oj+ur 6qviVL233huf0NbP8El9bX1tfEpfV18Xn9Y30DfAZ/SN9Y3xWX0zfTN8Tu+v98fn9R30HfAF fWd9Z3xR310fiH/RB+uD8TUjCPtxmhggBuLrYpDYF98Q+4lh+LY4XByOn4GfXYafg59Nwu/A z37A+RKRfiBU6iqNJj3laPkuCVdmKVHk8Of9LRCNbmErLl1x78Ize4qcwag60hVyj7LAaTzh +lpIWr4FWMFaJrWjxMKjRDi6CUnbZeOKXaHXVMTaX0H0wl5QZ0PcEJxLU9wU8XgJXsJ22aSi noKNUEKwFUoKdkIpwV5wEEoLjoKTUEYoK5QTnAUXobzgKrgJFYSKQiXBILgLHkJl/Au+hC/j K/gqvobT8HWcjm/gm/gWzsC38R18F9/D9/ED/BA/wo/xE/wUP8PPeY7nuWzuPfeBy+E+crnc Jy6Py+cK/ivneFCFJ2ymgWe/VjBlq1nWkDhkC4mHlisHmrohbV9aJUh6aNXqwBNrQBKRLyQJ 1Ud+SEZNIamoAyRj1Al1Bn7YDZIZ6gXJHPWFZIGGojBUDI1Co5EVCodUHEYnQTbYGJugEjBG bVBJbIftkB3b01AKxmsrZA/jtTNyYKu6pdlIdcQD8ADkxHY5lMHD8HBUFo/D42BMT8fTkQue gWei8ngunovcYARHoQowgnejijgZp6BK+Bg+jtzxaXwaVWbzTZ5s5FVlnLoJm3XqxmaderC5 MJsic2EV2G4qH9IFWqwkcSfuwByrau+JJPVJfbjShDQB5tiGtAHm2IF0QALwnyCkA+bTH5jj NPFHpBdninORJMaJ65CJuEGMR2biFfEqshTTxBvIWswQ7wGnHiuNRw7gRSYhJ81DIBfwEKuQ q4bnqBLg+RXkDih+E1UBJM9AVQHL76FqgOcPkBfEWI+QN2D6E1QdcP0Z8gFsfwG2+q0uFZku jUk/0MXuG128iTdc0TTiSCuIaXimkcA00gHP64wo00sPLG4wMmJ6iUwvhellxvSyELeI20Cj HeIeVILpaM90LC0+Ep+gsuIz8RXopWlakWnqzjStyjT1Aj+4FuKEdRBt1GJa+zGtG4J/ykZN wTvlQYTyefW1GYzPXkyjSpqOgN3auEdfz2glZxi9c/Gir+cI3oi3wZHF1/tgBHynDWoQaDfW EjyzrcDaQ8fag7L20LP2MALe2xWJrFUkZm2ZtY0idhI7IRUi8/HIGKKveWDzBeIyZAsx2B7k JO4Vk1BViMReIV8xU/yAgoBDTEUDgS3MRaOBHcSjSPD9u9FC8PVpaAWz+V5m85/Bg99B+5jl 9zPLH2CWT2SWP8gsn8Qsnwye/RVKAe+eiQ6Bh89Dh8Gf69BZ4DjW6ArwGgd0C7hMefQQWImE XgK7MEWZ4ONtIAIAJIQIaTBCWgSJ6mqzDKi1ttsGtZXGyH7oLHymJF76l+9j77r9m+7+2h8Q +00mxJpan29VpD8Yfu0PyF/7HXThOYIasLV7i6/3EcSJy8U18J3JYir08RxJGzlwlkX5n5/E gT2DofApvzxrdUCzfwHd4ZPFGBYihoWYYSHHsJBnWCgwLNQxLKQMC/UMC40YFooMCyWGhTLD QpVhoTHDQhOGhWYMC80ZFlowLCzGsNCKYaH21o5DoIFMGnH7UO0/XQsiWMRm8JSlcXnsgavj urgJbgNPF4D74VA8HPhTJJ6GZ+MF8K0xOA7H4x14Lz6Ij+CT+Dy0zQ1oh8f4JX6LP4ID0hGZ mBFrYkecSHlo46q4PGjvDG1RgcnO4IE12RV7M9kNV2eyO/ZhsgeuwWRPXJPJAOzLZCCuxWQv XJvJIFyHyd64PpPBuAGTA8CrazIEt2QySrDSJL9HsGYyQSiuSTVXL2lSMNfLmtSt0StMJupV Jg/qjZnM05swma83ZbJAb6ZJYFDmTNYyxux7+mEXQCNj4BoEjtwg7wyMQ+MvgEmgJfRE0NEd 8h7YA/KeuDLkARi4DOhWBfJeuCrkQbga5L1xXW3/Ca4HeX/sB/kA4CwEtGoEeShuDPlg3ATy IbgZ5FG4OeTLcQvIlwkWiIC+xSBPELTZl1w9GAY0hV4NevKQJ+qB84COOm1HlZ5Cnq/XQ16g N0IEdAMGpq+FXGBsdQGfPwB8/VikvQNgAVqO1qB4tAsdQEfQaXQJ3UD30XPAl8I1RehJ1tDX naAvGXBVXAN6UyPcAvtDa/QArQbgjdBaUdBCm5jsiuOZ7IY3M9kdb2GyB97KZACguyYD8XYm e+IdTPbCO5kMwruY7K0vqUnQ0U6ToGUpJhP19kwe1DswmacvzWS+3pHJAr2TJkHjMkzWwiuZ /aKZ5WKY5VYxy8Uyy61mNlvDbLaWWTGOWW4ds9x6ZrkNmj30FqzFi7EWt2QtbsVa3Jq1eHHW 4jasxUuwFrdlLY4Rb4zYznKOYQViIx0baz8T0d4l3oLt63dGHowHsNkwbMn6mhXrI9bad2u1 4OJfS321nqRhL+DJItZXWK6t0mETQCiEi0FchRkSEYYvml+1RtNxO9wBd8IdcXvcV+wIHrDz 57lpMoyMJ9PIQi6K28DtUD+peWq+WgAou0JcKUaLMeIqMVZcLa4BxE0RD4mHxSPiUfGYeFxM Vd+rROVUXhVUnUpVvZgjfhRzxU9inpgvFkgAe9JP0jxpvrRAWigtkhZLS6Sl0h4pQdor/Szt k/ZLB6RE6aB0Xboh3ZJuS3el+9JD6bH0VHouvZReS1kylfWykSzKkizLiqzKxrKr7CZXkCvK lWSD7C57yJVlT7mKXFWuJnvJ3nJ12UeuIdeUfeVacm25jlxXrifXl/1UWVVUVTVTzVUL9YOa o35US6i2qrYOWpZFnohFmwKwrqbg0/qRAcAcwiCqlMk4iCoVtm9WZTGkMYsMTdj8rym3nduO zHRbdduQuS5Bl4CK6d7r3gNnhHgJWWnxEnCrW+ID5KJFTcCkpgF/qC5tBuZQDyL+NNQMov50 1JzxhxaMP7Rk/KEV4w+tGX9ow/hDW8Yf/Bl/aMf4Q3vGHzow/tBRygfm0Ek2AbYQwNjCOMYW JqjFgC1MBD33oc5/xaL/mgX/Fjt9sZDIWhOx1jRi7WjG2rEEa0cnpnkFpnlVpnlrprk/40kd PkefgigobBQ2Qdrccl1kV7T//7YX/3F//Nx3oAZT1lMQ6ykcs7CO2VNl9jRm9jRh9jRl9jRj 9jRn9rRg9izG7GnJ7GnF7GnN7Fmc2dMG7GaFShQ+vSSoRZ5eBc5bOGK1Mc/6KWL9FLN+Slg/ 5Qo/KwvGRT5rDazkKwp8GekMOdgoYD1ZYD2Zsp6s/xxJ40ycjXML2YApsSQliCNx4RoLgUKQ 0EcIFoYKw4QRqoPqqJZRy6kuqqtaQa2kuquealXVS62u1lB91dpqXbW+2kjtpvZSe6t91YFq iDpYHaaOUEep4WqEOlmdpv6ozlLnqPPUBeoidYkapS5XV6oxaqy6Ro1T16sb1Xh1i7pd3anu VhPUn9X96kE1RT2sHlWPqyfUU+oZ9Zx6Qf1FvaxeVdPUdDVDfaG+VrPUt2r2f/Z9/mff53/b Lz1MgPP3FszVXPD5tf7SvnYYibif7kaRXch6bZfO1z0+/5d9Ol93+EAdpCbpVmSmQzvTFBDo 63wBfqv9xQpShXjBHfXgXEvSmrQnnUgX0guwKhRQb5y2rva9pK2lFU1Qy7fJ6/dJW3krmrR1 uu+mer9JDbRVvG9Sy98nbUWvaAJd/iCBP/gmgc7fpk7fS+A/vknQSt+mbiz9etzrN6kPpH5/ kEK/l6T8bxN4rW9T8d+k0t+mQv0+Py+r4T/zI38wP4LRLfCfNcDXNwKW7c/exfLlDSza21h+ RHPRIoh+YtF6tAXin30oGR2DCOgiugbtZ2Drzf+vude/lLf8V/LvzoJ8niORQSzS4h5UR4sF wNdZsuhBW2fB2AXiaALeXntH4iK8GMpLsPaOzZUQeRG8G7+C8mucCfFKFqAJBm+ZDeX3OIf5 zFwof8L5UC4g2t9AIoTX3tlIdFCm7K8ISQTib6IQY/ZrTIixiRnR3lBXjFhC2Ypo7z2zISWg bEscoFyaQORGnEg5KDsTFyiXZ3+xyJW4QtmNuEG5AqkA5YpEe1/ZMrIMysvJciivICugvJJr yN4n3BhxXBPBXHtrqwD6Cjba3/ASGggNESc0EnpCOUAIhnI/YbD2LndhBJRHCpOgPFmYDOUp QrL2/m0hBcqH9IDMegJRJNGXNeqPsNEAI2B6RgOVDQgrGxWIepVNSgqUDylHoXwMmCpW7YBn cMAmC1iEB6hsTIwdPv/OmlmGoIDCXwf/ykEw4yCYcRBc5FesmHEQzDgIZhwEMw6CGQfBjINg xkEw4yCYcRDMOAhmHAQzDvL5CQljIpgxEcyYCGZMBDMmghkTwYyJYMZEMGMimDERzJgIZkwE MyaCGRPBjIlgxkQwYyKYMRHMmAhmTAQzJoIZE8GMiWDGRDBjIpgxEcyYCGZMBDMmghkTwYyJ YMZEMGMimDERzJgIZkwEMyaCGRPBjIlgxkQwYyKYMRHMmAhmTAQzJoIZE8GMiWDGRDBjIpgx EcyYCGZMBDMmghkTwYyJYMZEMGMimDERzJgIZkwEMyaCGRPBjIlgxkQwYyKYMRHMmAhmTAQz JoIZE8GMiWDGRDBjIpgxEcyYCGZMBDMmghkT+fKOkq9vLCkxFKQFO4tK9DdEluijMyo/pdGU 9wqmJCayREc45U8wdpcMRjrBVeWIjYAMPXWiqw7zOLIawXxMW0Nrg1uRM7axdhNs2ZJSDdQS BaChKARANAiFwX9ticnX4FCkMt6ixyTfHS1rTcutMqhhN92H2Y27RSd1jIm0LG+I5M0MkeRj DEcwAXBIQTNq1JhmesE3O/B5Rm2D8vVJMQ/PFOruanDRce14ybx0vZDQUUOC+/QNs3cOdLF3 9/auZt88OHBIyNCQ3mH29UKGhFZ0tzPYfr652LdXQob0DAsOGeTuYCilXefMrX+93iYkJMy+ zrCwviFDgsNGGeysFO9qBnd3g6GaAf51tlI8DO4eld0LD/+BJ4rEpYs2CxYQFwmwAudFEokx 2kASU0If+mS1KOEcvXhkN8PT2A2zynT/kL+w2eqE/BWx9r5jW8cui53Tw6P/hbq9Rr2MH37C /3rWs+VTbOdET+q982j/0QGOV0rWuGWM5z1edCSpQu+oqL5ll56v7pYk7+5YNqXBI9HXa5Hb Bmfv9c8bT6x7b5Lx/qgB7XrGR45d1aPCiGZPlu7q5RPVytZd72QRveHRT67WD2suCbTo0VEI ii5Zrc3U9+teLSDHSvyS1M5v5/QJSdWf+y9osSVv3eiBYS22Wp9eZOTsgDrM7RFcbX9TM1qj fcEPuWt6i/q4ixHtO7za49PNMmIEfz374JYJC/O3nQm/ss5mSJcaJw+81q8ubdipm3xip/0I 88kZhIOOvzpivSFirSEiFlqzJOYjogwRiyeY/HA+9FXwkJWOrcdb7Gg+u+DUqiH/fvtF/kkf 5zQbLnwsJc96s9i6you92OnaCNM3XXp4RK+UTvkKP02bc6L6Q4es1x3mu+2OaZga8OrT1dM+ Pp03VPUPzncaWOvE6Y23hLE33WfVjDYJ7bc/36yldXDyp/P17pl2tm/5NGDM1o3FU12rlalw MGiV2Y9ljANXv/e3zXE4caXYmzbxg+p50LxIqw8P+gxQWmcnZrY5nvjoiOGTvbvRtJILXWya Xy5J1mZOuM3t+uHt9pupHV4GNT7exn/PLs7ZrGDuldf6OeP3Lj66qZrb/dH314+4NzwGne9X K+Vi1R9v1zFbX6VfiX7pVe5csuXvr/fjUztX9hrU3FYJSBBjZ/5y2b9WgzO27eJC082qT50/ LHrdxRhAhR6GSK7ZZ1QQK24yvdGqoMuKU8lfMKXkPwUGMO69POAfIIAHgIG7BxxW+QIGoxiC QiU6c9Kurbu5wVQ70JuLHXoO7Rs8qE8YfI2JQdVOUnPaJqjXwJBBvb48mPhHD+ZocPj8YDZF r/cKsm8b3GcQ1Grfql6dP0WFhFHjrnTd6ee93jPe/XpOmSqNRyTnllp53G/wqwsNHl+aebh/ szYBb5eSw82vNR5Qyck3KOmsY4LUKCF82E2/xI1z1FZHy7hmxTxSHEtdqOP0MWDpueJ+a+c3 KbX0zM5KpQ83qTA2JK2Ync9MbxPvm4kub3v7VMAeBfnlGsXtHoCnLs/dtyMwPDKnS0zEpMmz t2XtXbD6nFdcq8lW5aa2uGnIRjXfHsupGXFwyosB3usqembvqrhVHBfw08jey5cMVaZszTry xv7nlmazAk+5pXn4FX+5v8kin1Ztrc/2bj1q4+apqe19oyNbTRskbK+SMsYpsU3vmktbnHYd X3nQpIa6CyvPN5lCBk1Ba5KnZrQtRIWPhoj3BnMNFMrwskHU6cGhCQLluP8ZUGGsPaM5UENe MHAgDCW1EypvyVucLnl2OAr9YWvm9SMtolrXr7i6fuBrg6RdNuZ5GEZTigwdhjFjNm0Z36Rs 1tkDLcJiO5YLKz9s55S8Tc0WjETNn5x8Zn0j+KgaO/YNqXfs5NTTH9qePhSd2D7kdWD9DfXR y0WpUZdt90rRxZUFV6/bbXYZ9+pF3ND4Obe8Z9dc0u+A18CL07Y65mU8uRJs9NO0xPw7aL/n m/djc0zMKgrPXBbNr9vfeXCC15zbVDnRte+ZxAl1+vdevz9h/2zPk1mcydjR7y7erpsxJv/O nfj87IzLys7QK/PutdzjFTu2wqWa6Z5SQDUSHdHPcXp2l8A52zrv977aY2a7STaV3/ksiYmU Y7vP2OmWsGrtqU3X7fckGYpPtrdQyh9o87bO7W6Ge/Ocg6emhN59s27T2Ql1hwxXAWP6Aca0 KcSYnsYjmzOGxBUdRwLgzD84qr8ATmWDARCnMgCOwdvgoR1W1g4NYX/LoxVe5/7g+p9iTWy6 OOvcoZTGy85srO652bFT//QBBx1KJyxIfbol6djlsoc8TGccuN7VLbdqe7tirlvmKDctVg9y bhZuWatO/Kza2xtMU9IiFmxerDvfof7wLk8zP6l3w8NWVz4V9uDVvZ6rxnMJfgWXfc0ubzvZ TTk/JivBXPnUo5/z5GEzEzYfmPzYatfcg+8s9wR0fWGaUf2lww8ztk4Yetjv3sLpI3ose7R5 REq1WZUtKpmnB5zYYrOh5ZI+my/ZexsG357Vp8HdY7ZvlVZhdSo9Fpz6OfRvvG3ekR3ex+uu HdjFusmmOVdnT/QdKTa8tmbHJMfDd7PG9N7eJCyxbJ2my3ta9GhhSI18c14KHfuyXfMRF/Xt hkcUYs0HQ8Q71vYljbURC4NQl1xkwL5xqD17bOsP/k2XPLC62m+ip1Cx7OPvQ5OGEyUdeWuD 5YTvD/P62g2l+JoGH4N3TLWYKlMq9w0LC61eqVLgkAEVB36xYcXAkIGVQvsHa2crhQ4J6TUs MGxopXptoaNVhFOGRl++EnhIDUN1g9eXYwOZ4lZY4YgRI75XYdCQIjWF/WYAMbSp3SGkbZ+V 9hM9sfrQqmmNzc+uRYS/VEaFjWi5uKH1G1QseHx6wNzYvD6rlt93dvnY7urS/FZJ3Yx2/hz3 IvLNEruQTh/fZd6Rf5mh97W0sr+QvNuvob5sjw5GTRe81p/e13zQ67uNzJyrzHAYktF9z9Zg M6cFL594GqWPHxQyT2xzsnyzxhs93KY8XnW6a9kDB2rc/mHHRGlfFduWk/waFuxfsKoT3bDo 5sjEDuFr17U4nbV5eVSdu6e6OPneCPds2CL7XOqYFc/2nFgeaNF26+aoV1eTzsWs2rTw5GjX qW7Jx9M+DeCuJ3ltzrzQpbiVcfL7kxPiTPQ2N+c6Ptq2qpnv022mZUeqKW4/r+l/fE4NQJsV gDaTv6BN47EvGNoI/xza+AcPDBoa1nNgaFG0qWrwdq9qcK9SxYPRG3d26GHQDg0RcX/Ls5Uz lPnsKO0G1QsO7Rs0xL5+Wz97v7Ytqrsb6ntVqOLlWa1CvboNvL7cyJnb/YESbYOGDA8ODPpT gHq6TwhMTRu1ZVJ937U7j7xottIpw3u4ndEVjyYdR150TVtL5756VDM3sezY1bkPxo33OJdW c4Z3tawP13w8LS/Ni8z1fN538hCbObf3Nru9d/KbyiJJiR0+tEqzrpkJd5qMK7l3wcj0ArvJ xeo2GHw2vFwHswsTW/qc+3gre8aLWuje5Vs9c6xmNV0TUeNdcO2nd6Yn0Zb7wsY8kR80fLpp QOblPhH6D5Ynx5nvH3rXqNnHgNwXMd5R1fOfmab2tAvoeE30n3jZp2nTu+0SK/WwmT1PqHe9 67NI0XGxUYzgHjRjfgu7Og6x8+bm+dX3C6my3a/a5uANQTme9bZbHfLxvmMyM8tm6j3/VqV8 VrhvLgpQvwLS+CGvK9Zq73K7zPu+e/GnpnfGn7vn+w32hDxuUWvxz56bmk6Zc2D503ifOvWO nf8vYU/Y0NDAnv8t2POlprDvIaj+dyj8HYAKHh1pJFteuHWuwfSKSRc8R0eEl3OuU/7NLw7z 1MWbu7ft5pLzIsW/yfpx783PSxY5zbOmFEOD7k0s6ey3zs3b42ZIVLXOLx3bzPHnZtVat7yX V3bVVIt6e6r7LjmhHB4c4fym9zr3u126zslp0+ZOl2fz564INmo2/cKF4c08lX53xtZf5/rD RP9wP6fiZY782OBomXvFJwS7WGRbHXtd2i2iQTfXtzlxx0b4OobkxPWaPDs2QNlQwW79g7m+ 4QXbZn9a/Dwzj996pvHZzmHxH9+YlyrhfXb1risH3u56mbo5q71dbo3M1Cvl6x9IWl5rXG/r MzvsA8WTtWsGeRQfu2NvzZSyjVqULr500ExDSuZP3wKUST9pactkVGaTabpfqY6j+8T+Fqb+ meCrEJ0Mnp7VNHTyhsN/IPj6HXD+Gd7cqDYod2tq3SaDrVPPNvJtm/xxk8U+N4/9Zi3bpE58 4Vs5rbH7POc9P/W6XarVpH2Hml4IFz68GnZwxvH1l7cEh/YeWa734z0Jryb/fOblxjyzNVKn 0i6VztVOa8+XGL57YK+BTfzTb2beSoqeeHxCRngzUm3Bu+SV+vZ2fRueSUse3qXSuD1l+P+z LWHRWTLJ/xtqbN5dZVH1tSwvYY89FHOjzVyn9CTfKzlLzpqyf3Nz8qoevLHrnz6vkC9ey18i KcFo3qVmP22lmAzX7nv6LQIBm35ulerNeac6W/jHaYHrrXxfmsqKzY5NrVp0JoHtDeuGNuPt P6ZEtzi2RLROydsgr+NxJn+O84OsF/VqfdmQ8qaJUQMYIirYc+iQ6H4JsHFCB0BFGUF9Kgak 0hNr4SgJ1yDCxMIjx8UQzFDKkMTgzOCI2jXD6NdhKaCm+AoaHqoJ2C3YtzCRnZGvp8C1931x yF57Tlbd/zsCg1tl3lpO3L44jPtezzZr6Yu/1yw/uX1joKJ0PkdmXTbzIiW3tzlbcmuUdrhd bvncy7+Pvcvs4Ou6lwWxrvMnXTpz7m7fgYf7tc7WvDm5zuhq+87TyUfMLkoo7i+7Zz1rs3Tx PMWOG1u2CIX0fJlzKNVrlobanIQufuvjwqkVHrvPr2228t+QFHHP4OVLS9nHnZ9uWTb+FFbs SWlIZmOZ9mkWk7N+tVvHrv9MN1N/et27xVwyeTNrHs+ZuXc0Ems8PorPEVS0YJJpX8N2dJrR jqcOx4Jt967svPcizbz3i9K0OWc2lIcEWl0rctmk/M2wiWU9sJBazcTIaNDYPoC9MpS+ImKM e0HjLQMReHxrMBqyM7OCVy+DUgE0MjmZDXmQh9WBrkHwuA35DJBlRQ2UERpZDIFp7G1OkX9k d3petpgNG9ff+SIpp5pWGqQgaeExDDMIWaDVoMHgy5DJkMxQxJAPHplPYyhhUGAIYahkKADy 0oHiiUBWBkPlQrUGFZzVa0llQX56UWJBRqUCWvHG0sTIwJ30orGi9/KcPqlvXl5zXl2fe/XM PPckTacjtxxes4R88zs59eCXP/+TF75+wFB5WHmx+vS0I12OrXIxM19X31Jlfn2+4PneQ1Fe B9wiHiV8Mp3i9utVnanZ8lOpB1ZXSUUdyLKaxzVTJFEi9umXrw7HzimcdnC+8O+TzL6MuDpH vlXu/ozJT83Un17Pb/Pf32o3nanW0rvvrkbcXvG93j6TTyjIz/30eP+WVWfehkxZOuGIeH37 W+mGwu8X+A5sc3xh4f/4zI6k2fecympmybMfXrl9xyr9XLcb99h5e7ZVPo6Kzj39+uPLc2av d3mkva848cdm/rZjwjprBC0edv1aIZHGnviwu4UxPtJzt9/CJiZ5gyYmaUQcsRk2MfEAhTjo nkTRaySUDgY7NIkuiDWQQE6J3IhZIEagnXAZVkN+YFVrYWhgBKxojSyNzaIwEuJmq1nT/Vpf BgpzdHt9WWTVp5YknY9WZoGSiKPTZb5pR2pv6y5NZLSR5Cs6r1cREp2v3ObzlmtikK5UvUvq z7kPF5+bLu22+0OYibL0xtoNWRNYJga3fvfJOmJ0ype7uOetdR1L24YKSalnbPZO8+837225 IbtUi1UiXC3nkPnkqnt7dq2Sely079TUNv+iWY8WfBPU/HLN8GDd9OlML+eVlk9i2F6z2c3+ 1Pelm26wqXmfOZztEzB5z/eFqkuv5nkWuPSurL/+6qnAGTmJRVFXSlN4isuLnVU1d0rcf9Dx c7uqlyHn/wtKy29vlZu34ZeOxR5uydYV8zZtifQP8Wud8vnO6YdfLP5axJze43Podmxia8bq tj0v0xdvX1l1iHWlpejP7bo1SQwAwbsK4g0KZW5kc3RyZWFtDQplbmRvYmoNCjgzIDAgb2Jq DQpbIDIyNiAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAg MCAwIDAgMCAwIDAgMCAwIDAgMCAwIDUyMiAwIDQ4OCAwIDAgMCAwIDAgMCAwIDAgMCA2NTQg MCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDUxNCAwIDQxNiA1MTQgNDc4IDMw NSAwIDUxNCAyMzAgMCAwIDAgNzkxIDUxNCAwIDAgMCAzNDMgMCAzMzUgNTE0IDQ0NiAwIDQz M10gDQplbmRvYmoNCjg0IDAgb2JqDQo8PC9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDc4 NjUzL0xlbmd0aDEgMTY2OTI4Pj4NCnN0cmVhbQ0KeJzsfAl8VNX1/3nL7Pu+JbNkkskyCSEL WSAhQzbIwhKSwYQ1Iew7gaAgIHXDRlxR675UW7XYdhhEg1pFG+nPWkWtRWtFsWq1rVG7qBUl 8z/vnZmQ5Id1+XX9/OfeOfd77rnn3HfvuefedyeBAAMAFix4mFXb2jB1ckx6HNgNlwC4Lqmr rm2r3Pv+QYBr7geQFdVVN9fEDn/3OYCrUgC466fW1tUbUlJvAXbNHqyfnDprZuvR7X96BeCm d4G5yDi1NVytf2HJZ8B6Pwdounxma37hp+8cqgdgXsandnav7dqQ/dzEHoCsCrRv796y2fvQ zmd/BlB3H4DEvGzD8rV3/KEa+eA1AArT8q5NGyAF/Ph8Ndrrl6/ZuuwO18NvADQeBrAdXrG0 a8lb3x76NfY/H9tLVqBAc6+2FutoD+kr1m4+Z/atUh8AWwYQYFcv7VkX+tXkVwG+1YY6c9as 7+5qljcYABbvAnC/sLbrnA2Opw1XYFs/2nvXda1d+kRt5VGA83FM2tCG9Zs2x/RwMcCV7wnt G3qWblj009gJgOJ7AAwsCL6V3Nr/SOO8ixbpKj4ChxyE9PAft/9CwCfTrt9wsvjU00qzPAVY UCBRQjspDAEzoLz9ZPFJFbYDcyOMSNwNgo5uBcwHiShgQQ/50IleGjRQLxwfZK7EVrnkBkkR dukm5J6Di1mQA6uTsCzLK1n+DWBjIbgvhjYKwXB6q9crjvx2GoPsVjaAgtvETn8iMQgzxd61 p0fDHIVvnPhxsOmr6HHvQvs3f8o/P0lfgtlf1CapgJ5/5ViSKZn+VYlPhZZvYse1QfM36Z97 AaZ/FTt2Y6zym4zrPy3h/KsSPHPsNP/PSNI2qBr5vH9kYh/9Zv2yP4KN/+ixfFHCuW/4qrrc VbD9jPKzY8/9o8aTTMmUTMmUTP+9ib0JHv53j+G/LXET4JN/9xiSKZmSKZmSKZmSKZmSKZmS KZmSKZmSKZmSKZmSKZmSKZn+P05cnFLEfzEGMIA15NgI8HAPCP9SzIuckDSQBjVQB9NhJnTB MlgJ66AHtsA5cHssFtfwjtDohhWwFjU2xzWY2EcAsaOxl2KfxD6HOwQDRs44sZwR644/PWXE yKzxmjMxUq6R+w6jZ5yMm8li5jILmBuZg8xhkDLvie1/ivdxOjHAxv9FHgt/PzGnn/C1vHem ZITR8xBSLVLTl5syOM7EDJHDOcblvcyWOLcHieYNzJH/81j/+Yn7h/b2XxKTofpFCxfMnze3 oz3c1jq7ZdbMGdObmxobpk2tr6utqZ4SqppcWTFpYnlZacmE/HF5uVmBjHR/msduNuh1GpVS IZdJJTzHMpBb56/v9EYCnRE+4J82LU+o+7tQ0DVC0Bnxoqh+tE7E2ymqeUdrhlBz2RjNEGmG hjUZvbcCKvJyvXV+b+SZWr+3n5nb0o78ZbX+Dm9kUOSnizwfECsarPh8aOGts6+o9UaYTm9d pH7Lir66zlrsb79KWeOvWarMy4X9ShWyKuQiWf4N+5msyYzIsFl1E/ezINcIj41wGXVdSyKz Wtrral0+X4cogxqxr4i0JiIT+/KuFMYMl3r35x7u29Ovh8WdQfUS/5Ku+e0RrguN+ri6vr7d EUMwku2vjWRve8uOU14ayfXX1kWCfuysafbwA5iIJEPv9/Z9BDh4/+B7oyVdcYk0Q/8RCKww xWE3YXuCBxwbjhDn5/MJY7m0PwSLsRLZ1dJOdS8sdkUhlB/siLCdQsvhRIslLLTsSrQMm3f6 fcJS1XXGP1tW2CO7FnvzctH74icDP9jujXCBzsXdKwTsWtrnr60lv7W1R0K1yIS64nOt2z8+ H/W7OnESKwU3tLRH8v0bImZ/NSmgwCuswcrWdtEkbhYx10SgsztuFcmvqxXG5a3r66ylAQp9 +VvaD0FR7MT+Yq/rQBEUQ4cwjoi1BhclUNfXvmRZxNPpWoLxuczb7vJFQh3ovg5/+9IOYZX8 +kj2CXycT3yiaIVzG6OdUBZmLsuQe9tZF9chrBYKvPVY+KsrsEGPyyVWhRWtrvC2My5IqOFT 4hoCN6ofrHAZNdOEJk4wrZnm8nX4KP2dIbniY5JkROQj+tKjYHhM9JwvHBppCwPK9tYtrR0x wFGdSuIDjPd25nGygi/iD0YLubCc0xJNXAbuXJSx2I0oElbR7o3ALG+7f6m/w48xFJrVLsxN 8LW4vk2t/qaWue3iasejpG1UjdrLqBYBHzYnKmwNxmB90JVYVrE+VawPV6eNaW5INHv75P6m 1j6hc3+8Q/DiDsJJSwMNXZeWGYtxa9bj6eav7/J79d76vq7+2K7FfftDob4NdZ0rJgp9+BuW 9Plb2ytc4lhnt+9wbRMeZYQmpqmtOi8Xz57q/X7mkpb9IeaS1rnth/T4mrmkrT3KMmxNZ3XH /nRsaz/kBQiJUlaQCkKh4hUqQk+zsSIX9V2HQgC7xFZeFIj17n4GRJk8IWOgu58lmT4hY1HG kywkyoSEi2RfgS7G47bOu0RYnu0dK/o6O4TNBVZcSvwwEcY/GSKsf/J+hpWqI0r/0uqIyl8t yKsEeRXJpYJchoHBWBl0jnAm9XX68ZzCgGoHF0OhyAldevtjsbZ23zOuwQ4fhtp8pLntEUUQ z35JRiPqTRWoE8VTI7u6u4RxQLhdsJVlNHR3YNgmOkSVhogCe1DEe0CNetFGCEc06sa1wQUU 7XdhJbKrI9IRFB7avrJDDGd9BKb5J+KyU5+SgPCg/I4+o79Q3Ju4FZQZuwVQ4NigtZ0kLqzi wzrISTI1jrzbj03dnV70Ng/drRjqdJYqXSRZikciH1gqktIVbwRhWlyGSqOMKMZhh/gReNU4 YUtKMmQdHTR4sbY7roDP1kdUOKLACFfGDdA72NQgjAU/u3GogurjQjct/TDbfw6eLMKgxZ5k 2BzRZDR04eFP9iqU+MsSxnLhjFDF+xggqUyYuRr9zmW09cfu9m/1jUh5uX7h5SAEJrgOYWBD R99YQWReMC9XPlaqEcV9fXLNmQ3IX3LNMKIQ9iu4fnZb1D3Z089uJTgn6lYhnE2wJeqeiNBL sJlUNkXdkxB6ou4KhI0EGwjWR92VCOsI1pLBGoLV0dQpCKsIVkZTqxFWRFNrEJYTLCNYSrCE oJsMFpNBF0EntS0iWBhNqUNYQDCfYB7BXIIOgnaCswjmEIQJ2ghmE7QQzCKYSTAjmlKLMJ1q zQRNBI0EDQTTCKYS1BPUEdRGXQ0INVFXI0I1wRSCUNTVhFBFMDnqakaoJKggmEQwkaCVoJz6 LCMopc5KCCYQFFOfRQSFZFdAMJ4gn2AcQR51lkvmQbLLobZsgiyCTNIMEGSQQTqBn+zSSNNH 4CXwELgJUqPOGQgpBK6ocyaCk8BBYKc2G4GVhBYCM4GJ2owEBhLqqaYj0JJQQ6AmUBEoCRRR xywEedTRgiAjkBJICHhS4ajGEjAEIAITIxgiOCUaMJ9T7TOCkwSfEvyN4BOCj6P2VoSPCP4a tbch/IXgzwR/IviQVD4geJ+EgwTvEfyR4A+k8nuCdwneobbfEbxN8BbBm6TyW4I3SHiC4HWC 1wiOR21zEF4l+E3UdhbCKwS/JuHLBC+R8BjBrwheJPglqbxAteep9hzBURI+S/AMwS8Inib4 OWk+RfA/JPwZwRGCJwkGolY8l5ifRq1VCE8QPB61zkM4TPAYwaMEPyF4hOBhgofI7hBBPwkf JHiA4CDB/QQHCKIE+8kuQmP5MdV+RPBDUrmPYB/BDwjuJbiH7O4mg++T8HsEdxHcSfBdgjsI bie4jeDWqGUxwi0EN0ct3Qg3RS1LEG6MWpYi3BC1LEO4nuA7BNcRXEtwDcFegqujli6Eq6jP K6nPK6jPywkuo673kMGlBH2k+W1SuSRqCSPsps4ups4uIriQNC+gXs4n828R7CI4j2AnwQ6C 7QTnEmyLWvBMZrbSE86hrs8m2EJP6KWxbCbYRM/rIfONBBsI1hOsI1hLsIZgNU1lFT1vJcGK qKUEYTnBsqj5fISlUbMQu0ui5vMQuqNmwW4xCbui5hBCJwkXkXBh1LwTYUHUfAHC/Kj5IoR5 URO+hJm5UZMboYOgPWpSIpxFMCdqwtc8E46a8P3OtBG0EsyOmvA1z7RETfhiZ2YRzIwahVHP iBrrEaYTNJOwiaCRhA0E0wimRo343mTqSaWOhLUENVHDVITqqEHYlFOihnaEUNTQgVAVNcxF mExQGTUI0VpBMIlgIkF51BBEKIsachFKo4ZyhBKCCVGD8KBielARQWHUIHiwgGB81CA4Mp9g HI0ljyCXhhSkIeUQZNOQsggyaRABggyCdAI/GaSRpo+G5KVBeOh5boJU0kwhcJG5k8BBYCdN G4GVBmghMNM4TfQgI4GB7PQEOgItgYZU1FRTRfULEJRR/UIERVS/CEFOICOQEkhIkydNjoQs AUMAoRhiDPWGEE8hfY70GdJJlH2Khn9D/hOkj5E+QvqrbrHnL0h/1nV7/qRb4vkQ6QOk95EG Uf4e0h+x7Q9Y/z3Su0jvIP0O5W8jvYX8m4i/RXoD9U5g/XWk15COI72K9BukV7TLPb/WrvC8 jPQS0jGkX6HsRcRfIr2A9DzWn0M8ivQs0jNIv0B6GunnSE8h/Y9mtednmjWeI5ocz5OIA5pc z09R9gTyj2vWekKxw5pVnsc0Kz2PalZ4foItj2gKPA8jPYR0SL3R06/u8Tyo3uR5QL3ZcxDp fqQDWI8i7kedCNKPkX6E9EOk+5D2If0A6V7VTs89qm2eu1VbPd9H/J5qu+cu1Q7PnSj/LtId SLcj3YZ0K9ItSDcj3YR0oyrPcwPS9cq7Pd9Rfs9zHeK1SNcg7UW6WrnCc5XyfM+Vyps8Vyhv 8VyuvM1zGcr3IF3EZXgu5Mo8FzBlnvPDu8Lf2rcrfF54R3jnvh1h1Q5GtcO1o2nHuTv27fjN jpBRqtwe3hY+d9+28Nbw2eFz9p0dfoj9NixjLwlVhLfs6w3zvebezb3cX3uZfb1MbS8zvpdh oVff6+3l1JvDPeFN+3rC0DOrZ1dPpIefFOk50cNCD6Psjx0+0ONy1yOGtvdo9PUbw+vDG/at D69btja8Cge4smx5eMW+5eFlZUvCS/ctCXeXLQ53lXWGF5UtCC/ctyA8v2xueN6+ueGOsvbw Wag/p6wtHN7XFm4tawnP3tcSnlk2IzwD5dPLmsLN+5rCjWXTwg37poWnltWH63DykKJP8aZw emEAM1JwJPjdt3q8K+Q64frQxYMr4jrs4ow6p8fJZuscTM1MB7PecZ7jCgensx+1syF7dm69 znbU9rrtAxtvCtmyx9WDVW/1WjmLMDfr9LZ6EatqCQsmiHOdbvUH6nUWRmfxWNg6j4UBwwnD hwbO8pj+qJ7V6RidLqZjQzpU12k9WlYoYloupC0orddpPBpWKGIazhrSoEToMVM9q61ep/Ko 2HCVaqaKDamqaupDqrzx9cAxXoYRfvPhZTi5MArG4qnHfX3AykgYfJ/vb2sNBpv6ZbHZTRH5 rHkR5pJIRqtQhlrmRqSX4LfuufPa9zPM5R37GbamLWIWflok1i+67DKoTm2KpLa2R25P7WiK 7EImJDAxZCB1vxWqO4ILN/VuCgY3L8Ri4abNQfGDNaZXqAUFofDZtBnrQu4V6xD8u4nUEBZt wrQ5Idz8963+axPz7x7Af3iyL1oo/MJIdivA0N5Rv9OaBatgE+zCfDFcBnvhMfgNLIYLkLsB bofvw70QgcfhKXjp//7rs9NpaKtkLai5B0EKJoDYydjg0PeR+iXaEZK9WDPx3tOSmD72/hjZ +0N7Y/qhfqkRlKKthn0BpX9hTsVOslVCPVYi1NndyOtEiz/Jbh368dDdo4bTCM3QBmGYA2dB B8yEGUizoAWmwwJYJP7ebgkshWWwHFbASvTXalgDa2Ed0jJYDxtgI/SgDzdDL2xBfnNcQvVz YCtsgx1xPBe2I78Vy20itxPOQ89/axjPH8bTkgvgIqQLsbwYdsMl8G1EoRwtG13rg0thD67n 5XDFMH/FGaUCfyVci3QVXI2rfg3y1+Pa3wg3wc2idC9cB98Ra7fBd7H9ulG6Qttp/VvgVtS6 He5AzTsxeu4eoyto3gaPwE8wpo7AoxhtjyH3BBxC/gl4HU7AW/AOvAu/Z4JMCTMV/gx/haPo /WXodcHnG8RyJZbLhz1+Nvo24dmd6LHRftgSbyN/ni/6KdF2NmruxtU4f4RNn7hOib4E7URf I/0lzEmY0WkZzXDvsOT0vEdbkd5In4324I2iZHTrWM+O5O/4wpY74XtId2EprMPYWoK7B3e4 QD+AfXAfclSerie4H8KP4Md4FuyHA3AQHoAHoX+4fj/WTrdHRUlC58zyh+BhMQoeg8Pi+v8U BkTZY8gdirc+Fm95SOSfgJ/hKfQ0/AKegScxdn4m0tPwLMbH8/ACnlqvwmvxCDomRpCfCcJz 8DwfgJclWkbCHYYn2BlwDtZfYm/AlQDJW6AV/v7R0CbuFTw9OJDBJPEUmHkwz5pnlVdMUTKD 0AAyZgmw4GX2gBwYZknIyLMZpVKuxaUxbGhhWmplbBtUHX/t+ILXjj+D+AyTf3zw2KD+1LFB Y3l5fn7BeMbgM4hk1rIymVTqTxvHlpaWlBQVFU5mJxSPY/1pWqTAhOLJbOlkrqjQzYqqpClK UVmQcq98Po+beUrKnuupWzcjnfW4tGa1hPFKPDZ55cxxJp1vQlZWKN8jU0pZiVwqz55Ym1a7 cKJz6CAnU8mUXqvVqZXwMrVc4XWYHFp+qF6iPflnifazGn7NZ9dwBcXLZ5dIrlfKWV4qfcRl y5hU73MEvSadSa/WSkxWo1RmMqoClY2nLpXbnDaZUilT65UKu90qVyilav2pMmBgU+xDfqvE DWWw8iF2B7sT2oPCvSjcfiA1FfT9bPiBPN7JOy0K4QtmcasFv3UeCGXNyQraq5zTB6sGDYLT mPzBgXJ0nevgl+sWjO9gzOQrdCRvMbtZwbFFhVaLWSuPu5AX/Mdv1do02kBoaXNb3/q20pSs 5nX1Mza2lBhUSo6XyBWWmq6ttcvu2lSVNaP3pic2N5w3N4vvs0xOzwhmVK3ec8PN9bN2zMn1 B/16PTrDaTOZM/2OyrP3b1r01KP3nNfgK8wU/i1POwCvxXjKg/tGzz+kV1iscqtVnpXp1Dg1 kImzYkLGrGBmVgRvuJYPLSxeiy0+ufC1M9hiRTgQ8rWJk8W5GsvzYdHCBRuD5cbyQSZ/QJi6 /khhkX7H7oEB9NQhUHzj7kQXanm/j/OJXhvFCdFqwgD0FfK4j2Rqg3JINps5oFZzvFylVw7N WMhySg0rtpy6WmXRSSXvyMbb2KU2flBisTstmqFV6DGLw27SDBXoDVKr3WFRywwuE39+pgc9 Njt2UjqAHpsIB8Z4rDrXZ9aMG2fKA6XF7M1TKvXeK/KY8XmMLo9RcXl5E/PV+GWiuGVcnsYE Sqs3T20x5+b7JmpdgRZXWB+WhIXpYjLayg1FVUx+UXCAKSwsd+Tj1BcsMATL7fkG3KUGpshQ hB8s0JOh1K/cIzouQ8uJG9rkZ4QgDGRyfi4hws0sxJ3NVMTEWZnkl6zS7HPYvUYJ+wZ7aqY8 Jys7jXkJeRIbJOwgb7S7tEu8wVQ9/7CErda5M/JSenR2g4R3yNQyCXpaxi//7FqtRqfGfXv9 sOxus9uk0DizUj7v4O52Zbq0ClOqRfj3Zz2xQYlR4gMb5MNZo338GLaXgx3S2VZQQyqTGTW1 Zvcz2QdCstP7DLfji4NijH2BQiKARmw2WfGo/chLjCnVa29/9fKe+zZNdNetv+PlPRv3bZrY 763fPHvFLZua8kyeaZtal9/c0zzOxM2f/ujAoSvayzd+f+2cI08+cFnrpE33bqvvbcufvv2W 268rnbppdl7Ttptuu06YW0tskHuD+zkE8PS+7CH2PHbX6RNHkSp39zM/vj+QGZiE++BHD4Iu wJi4QEE/6w7ZTKCYlJkakHK+hpxPnY0lfwtpp3PN4vqKkxLWWJg5xsrxQYwNvXDeCPFh/QqG QmQkjnoKB3KM1RY/zGWyQGDkeVXK5fLpOWanHrvV1C7omTRr5WSbJb9p1Z6OjvMKTXwgy+zS 88wv89fWlpxVU+DBL7MlwdL1nY1Gh0HLy1SKH3ibQzll8zdXll1+zZ71NdOq5um1nFwte6+u rqhtdc+6XH9dub9yzdXtwinVjF6bwz0FE2D3GJ+lpIBBcE9qVvEnWR4JI1F+nN/o/TgLHHoH q+Qc5pOhjOm08KdeFI6Q4GAVMgjDh3Yo5euaUvywp89w6+kjXEqvRiGoeG6OTGtSa90FTRND 3Q3j3Zq5HVMWTMnRyxW8QmOvmDm/4I7bLIUzeq7rymqcMiFVxs0wBnzW1HT3hPCadcsDy1d5 s706rdrndzvSU013fbfyqr19q0Maq89pjMcSX47fTXKhaqxfQkpfXlUaNijSSgX3OC1puVxm PQoVcpBqx3+a0jhxbBxgGFTh6UJ+KSrcsVsrntQhx1c2/V9RxCe2l81ENwUZkwgjK0VRHpee Y3HqJaxXjKJJZ03KsMis45tWXdoebJ5cbFnGKM1eh92D58/QMQymCeHaAq++umFkKN3ja6rK 9hTXNTR6Jl551aWrq02+cQ5mSKYRDhqN7NTiumkFs1dtXDeua3nFqqvPQs9Nx3i6BXfhOKgY 67kHcgpLpTwo+lltSOE3qN2c2ezP72c1IQv4pY+Wlua4DQZ14fM5jerXQ+7pI17uwtmcj2H1 ovC2spXj/rOJ+8/0FawSEeWXSkdFEysbuRuFY0pwHysTNLhbQpe8eM0qmaR7fWhZ03iFQsHL NXJ1ZduSwo6LO3IdJXPOvnlxW29T2r2zGqcsmV5qWLbysrCffRvvYjm+ya4lq0xWk0atTEl1 KtQ2kzqrdXvblGuvvnjZ5JzqltKiqrzmpWXOvApgYpVDe7kCyTl427x8zO4zug2eh5m38Swz MG+H/A0V00INk0INVmtDaBIPOeo3Z0x1V7w5yZNunDat5M1Q+szExAcwWk4NCEf1gA1vBvni e00/OHxmmb7cdMQhLrpEVhS/AtALDQ/RxD6kA8uU2JhF8VurzWrlClhOKldKZZaUgC1YmetW GZ5SaXipQqWV/XyfYWLburq8chnPczxqyWQanUWfUxlMVd+1S6nCK6tao9zp0FeE19dYx2d7 pFKppJQ3WGxmvLHKnaVt5XN1BpXdZtErP7+v7dyWTK1UolbyJkGB4zhUmMQVaoxym91qVO2Y fe6sTIlCLZUY8byrip3kIpKNMAV2jNnX/nGO9CkqUPpVdtWUYl5i+jRU3uh3KCF9nNSdXe9u ltC2FA51wV3iSyF/oNBQ9ExRoeBZ51e2G3lbKClJ3PxliesCE9/RWJcRazFLZehRpUXYsAYJ sx5f866gZ8L6RU2GWcKFwe5AMcsoWYXFJ6jwzCyJVqeT6mvnr58UmlvulMsccpWcx5uanM11 TrGnjvebJ6+9Jjy0MSGWlMnVAqeWD610lkwYb/Q3VeVkTJlbnF7rF85E9BzzgSQfTJANq0b7 7v5sj9kN/ezikErpcbvNnmw+3aHrZ6Y+IAmlNzjix9lr0wcNotOOvTgoXLHQZw9+ia4QiXGn xL8PjbhRiYfe7yWGlBx3asDISqRGF3IZJnbok9MuOcCI1ynBafwvMBSVSlsgJSXDoVA4Mj4r SMydu1BGc5cBxYjkHTzD5sHdY2KkvDYvb1y5zZrmm5E2D+ZhtOAtQlmWpmptNGR9GmpoLBvn synBmqdKmzejtlxbNLmhqDllOALiIYB7DCMnfwBffIaiQtyfAwhHkBMvnb6v29fYaAqMCqYz ieLOiweX7XSMSZYzSovPju6SshhjBZWFqzsbhQgThXops14mKawoWkXChI8PMni/NFtcOp5J 09XNX1teMafUyZnr568pq5lbZh8VeqnFzlBz5eq9c4bWnRa6JzoqG0YLuYtwRTjh2nJfGl5n fOUz8/3NVTmB6vZif206JHYyrtJEOHfMKgUKnE5XgNdyoGPMnE6bYfk0VNKY4dLyTl1BQO4N NnibFaM3JZ6WwnLgEgyvg/XLregb59dwNReRyzbiHk1sY5mkuHLsJh7lzdqFGysFH7LHcNan nj3tMs9Ea2XT33VZdk07eYn9M3qpCNaMvcdkGQypxhRITVH3M/aQPpTXaEwxZKVmSm1pDTaa 6LB38gcMRfE9ewjUX6I+9v3xRXFnxZHhntPI5Sab25zWMWeqYebonRv3g89W1diSafC7bVIp dzNvc3tdRplSNmnF5a1D6//39O/Kbi5Pk8gUUqkQJxtjH7BP8j+EOugb44HsktxgabBarpii mFKqCAbHl9pKbTC+elrplAp57puKoK9kmu5vId/wpQLfj4OFz5SX4/Z9RvjabSwXfCJ+8dbT l++Q6StYJ/zj5774TjL8VmWH36rie5h9kpUqVVrF75by0uB4V1aqVS5X4PtSJvfm5NvKZpe5 WImEW7pDpZaqTZqdQUZlFvezhAn+Tqfk9iosVit+cVdaig1F+QqlQqXTeNx2mUyrktqLppeo U71eLXNSY9JmeK3HZGoFzyvUsmNW9OMGvNn9lnsE73W9Y/yYprJDQUVhgT/dYQeVPb3A4a8o VEhKG9wNuX8L6adLTt9n6asUvjAHhBenQbyR2L6CzYgzbvhbVMlwQIl+TFxGErJcRmlMtZhd Ognr09ctWF9eu6DcoZCtjx9m6JF1UqlKfIt2NhlnMqqE2IHe5IUfjt2b1hTKypjSMcFX52eL E9F16gVnWaq7IN1cuebadubyhBg9tB1PpDvRQwUwZ7SHDoGP2R01WrMeZj0A4GU+C6lC1ryG NI2rQRPfOkJQ4WxfHNQfF75hhxRjm+OHDd4JyAGZXIDiQ/wSYMEgiccJd6eUz1iwcfcsmdHh tXoCFgVzEcPIjR6n02uQMmskkxa3NWVyKovfaXcbZNz3lBbV2teP/6pbpZaxvFyr5MIqg0yj xXnJNIpTTrW04+7owBaFRsZxEgXeWp/Ded6M88yHbaPn+Qj4WR04QMX6QhoG0tV2nnFgtmU8 zGpRXcP6Q9qQLachXW10NxibpYnjtDw++3z6UanRJt5YBTeoz6gs+MJkpe+JmZx4KQgESkoZ LpDwh3iHslqlMjZvQMpZMz0pXqOUu27obanGnuFOTTdwSmbLISlrCmALOuEKRitVW30ud8DI aZi3hqbh10uJ8MNSpnvoFplKykvURi3zCHMXynlOqpQNRZhZCByvNGnxdvRw7GN2u2QhWHCa k0Jmi8rqV7n81iw+6FZZQMnrJcF+Zvb97un6+qyE04JVVaeexa8ydCvKF4/XsRcc7sw/AL5X OBwtVqeOZ+/j1PZ0pyvNxHOvS1U6lTbX7/SbZBKlXqnP8aWmm2RMb+Jmxz2kMaokOBX1Z2u1 mZl+pU4r19l1mkBWhkqvUujtOJNPuGXcbEkv3vMyoQIvxGZmJ7jBgwsr/FhzJyjBxOpCClWm xJE+VT915GyOD+DlbvD4oP6UEMOjpmKVjamyv2YUBrvRaNPwzDRGZUuzjffzQ1mMQu9EoXqE kLs4MXzmqMDp9UMFYyW4q+758sxknSE//o/NbM+ofCKZ/3WZO/eLMy89Q76TsmTiGfJf/vlZ eqWQZZKvmV+Wr/4a+b0vzoorv0lW+s6Yrz2dVZ5kTuZkVl34H5tPJHMyJ3MyJ3MyJ3MyJ3My J3MyJ3MyJ3MyJ3MyJ3MyJ3MyJ/O/Pov/I5XBz2wsS+AwSOBCMEJT7D1IAWPsBJZNsdchhWFj v8FSH3sDS6fIu2OvYJkV+ymWvbEPsNwilnvE8sbY21geFPnDseehiTkS+5jRYz9/wVIfe1/4 S7Ii78bSjf0MYXlj7CMsD4uSI7FjTBbqv4OlPvY6lk6Rd8dOCL9RBwmWh0HNzEWr97A8HHsV yyOo0ytKekVJryjZIkq2iJItomQP2pqYG7H/t7DUx36PpVPk3bE/YHlj7AMsj8ROMYfxWWos bwQllsITj6DV81jqxdIplm4c7RHUkWJ5MEZ/pTmPTYPEXwVeIpac6G2tWBN4FtRcDiT+MvVk jo/zPKRwzjgvATtXHeelKJ8b52VwktsS5+WQw70X5xXg5TfEeSV7+/CzVDCHvzLOqyGH/12c 17DXS/RxXgtrZPcM/23pQrk5zjMgk9fHeRakinsTf0UaPIrr4jwPWsUdcV4CasXBOC9F+eNx XgY7FEfjvBwsSmWcV4Be2Rznlcys4WepIKicH+fVqL87zmuYZuXNcV4LJap3hb/kzSvifiae /Ew8+Zl48jPx/4+4MwGPqrob97kzyWxZAAWJRO2FIAJCCJsCIkYEWQSa0oq4tGYmmcCEbCYT trrEMUVAihR3SwVtaxAXKCpxJVEBISCGCEkwwYBAlDECIomxUu73nnMnG9Kv9P98z/PnPO9d zzm/9SwTncT0s3lt+tm8Nv1sXpt+Nq9NP5vXpp/Na9PP5rXpZ/Pa9LN5bfrZvDb9/JLQxRCR QBnB1VThEykiV2SLPEgTfvXbnLN5kqOObp74uMoS8by5UWRQdDGdZ/Kb4n5ayTsvZ6/6vdBe NIqnBzf1fMLDMx81fKqeGzLpK1XVzeIuj2dZ6p3Z3ocGOrhD34BewN08rvzIknXy6dHPcy93 Uud8Wqeq30k9S/WSHerVT43MkExZQ8fGbCXTq77HLm2ZpGxN44lbfcs6V1mhq7NbWSnlmnak 8GaA6jlTPclQPbrxkfm8RUom/WQoj+WEtMziSaaSavYp7fS300BKzFG2mP5u8bapu5SUjQd0 9a38WcoLPvUdcfmNfb+6kxb7W+Nh+syUoivds0J2ZSvfelTNNo3bWyS9Nl+1M62ew328yof2 0bxK9Zapelig/JAfinx7f8uImfZ7lf7SfjMuuSob5NmUKGOt00dOqzWmjrNCdfK4Wxjq3Y8V ZoTmtkbJrXLEzdPMDna1ZLP8jeRuJT8lJD/+PFk/6md2mvFpif+o1lEzXMwIZZEvlG/D6fEa 3nZsP7BD+/OPCG8ot01L3SHbZqm3pq7ekDel/qkqq6Utc1Q8W9qc/23afzW62zLJjNut3PmU DlL+r5Ul/g4xHhTSILudBSmhMelXVnpVnk/hSYroq+Lfjzqpqv8JSiuzrV/9PolR9DiISMoS r8Z/R83jVe+Z1PGTd1L/WcqCHHpYwFMZ3TRlixxVHXtteS5nFjMCc1r7u13pbGb0ApWJeUpD vxpzeWqOMFvrygY5Xr0q23xKhukhj2rb4r3x+G8Ks6XZNrfdG3OspyqftI3feUpWihrf55Nr 3su6KWRRvvJhaut4SFXv5YxjWtAyBnKUpVmhUWD25VVHOarPtVu+N2ePvrTqp7IzE7u8reP5 51pl/aznC/dRW+8tM7gemoPN7EnpMBf+3Pa2fO2o13XtPCAtMW0xV4SWrM9tXV1S1fyapeZZ 97+11PSzu4NPvaHsP3cMSK/KzMtXLVPVXCWt8bb2I2tmqPnuf4vQ/9W4aBsTg0K/48UdWqXi VaxyxPyX9CEJCSP0qb6U3Oy87DS/flN2bk52rtvvy86K12/MyNCn+2bN9ufp07153ty53tT4 m9wZPk+uT/fl6W49MzvVm5ul57mz8nTe+9L0NHemL2OBPs/nn63n5Xv8GV49Nzs/K9WXNStP z6aq35tJy6xUPSU7N8ubmxevT/LraV63Pz/Xm6fnet0Zus+PjJS8AXpephsNUtw5XMsmmfkZ fl8OXWblZ3pzqZnn9asO8vSc3Gz0lmrTe0ZG9jx9Norrvswcd4pf92XpfmkHmtFEz/BlISs7 Tff4ZqmOTUF+73w/jX1zvPF6yMyr8vRMd9YCPSUf4029/bOR752n57qxJdeH2TR0Z+r5OVIM Pc7iSZ5vIdX92Rg0V5rk1ue5czNNWdLNKbPduSjmzY1vdf2oFpnYI+0fJUMzfAYuwih9ePw1 Q0LvB5rv2wXCi7cR6kbaLJ/Uyouaue5Ub6Y7d46eLd+0u007f7iVk7Dt1iyfn/a/9rv9psWD 6CBbCUghkv5cnzcvfkp+Sl93Xj891atPyM3mrd+fM2rQoHnz5sVntnQen5KdOci/ICd7Vq47 Z/aCQSn+tOwsf16oqrxOc2PAHFnv9ux8HL1Az8/zogQmyde6m7h6czN9fqmQZ4FSb/ytU27k ba66Ieqp+WZ85832pcxu15azLyslIz9V+iJbT/Xl5WQgQEYgJ9dHhRRqebP88XqL7Ows0qOv r5/uzfTIRm1dZbVUPq9GqrpMcNyfh3tSzCxsla78GurrOqVAXx9SGAjS9blyuKRmz8vKyHa3 F4rOblNTHN8agex8f06+H7fP9aV4ZZ3Z3oyccwy6kFioSAxK9aa5GVLx7ryc+fLzmPqLLTFi 0Xl/rZVGDaf8/+SF3TBEp9Df/ZFfRurLebYQrZ/jzv/vIutTkZEadbQVF1o/KkrVb77Q+p06 yfqW5Aut37mzqr/9Qut36SLrWxMutP7FF1P/IvV3jxx89pP15SfurqG/YxQlxoke4hYxSLOI 0VpnMUHrIaZrV4i78Wi6dodYoP1WLNLyxWPaXPE3bZlYz+f9d7Q3xTatVOzRtola62TxFb2f prczHeUo1f6TnGTkzEHO75GzBDlPIqcIORuR8z5yypCzDzkHkfMNvf9Iv+fYY9HayYlGzmXI GYqcyciZgRwPcu5Bzn3IeRQ5zyHnFeSUIGcncqqQcxQ53yHnX9bJmtP6lBaDnJ4d5Vh7tZPT CTlXIOda5CQh5y7kzEbOfOQUIucp5BQhZxNydiBnH3IOIecEcn7Stml25FyMnDjkDOgoJ2xa OzmxyLkaOTcjx42cLOT8HjnLkPMMcl5Fzmbk7EbOYeScRM6/tDc1+dObS5HTBzlDkTMOOVM7 ygn/czs5lyNnFHJuQ44fOQHkrEDOeuS8j5wvkXNay9ds2lztcm2ZdrX2rDYSOZOQcxtyvMi5 FznLkfO0HJcOm+awjRiXWFBQsDhH3dybmDifu2aHU3O43AXugumUJ8QTYgnFYdccjtFjxwYC hYXzbeGazTZi4uIVK3LkZXjCxIKCFcmOcDpxONqe2xImniwoyHHZDUeYzTG6c+fOuq6XqmqJ iTkTJ65YscJh0RzWRJGYKPWwOTWb606RWjCuYIkSqjoxK9rCNFtYjqpmD9PsYYkn5XWyqjFR 1jA1QfSa0gKbjabj+iYkJC12WCyOsETVvyiwhlkc4UlJa6Qx9ss8srPC+R1td2mOiORSd+Kv Eqcnrix4vGAxxeHQHM4r3Dc++GBg0XybTbPZR48rXPz07Ha2O22a0x4WFtb2ImR8hN1wYnyr 9aoi6sxMHbd48eL/YL4UZVZsZ74jTJMWheyXVcaNG9cidPHiFUnJidJ+m2m/02Jxhuw3HeCU DnA6NKfjip7q6djRTjs6jdETE/FCQbMzUnNG6bRNSk5aM0mfpE/WCxMLE51Ozem6QvQUiQWy 1YPiQTFWjBZ2m2Z3YLU02x6u2W3SHzjEZddc+D6s5RXV7CPGFTYXFMyPshuu8JBLpE/0UpeN yrounSKNdVoY4sorKtwuzR55e0Fa4jjKYhUQJTRUWQoNn5msqjrDNGe4rp9UDZNVrXGmc5R8 NFmMVXa7sNvH9u7bue/EQpdVc9FCl7JEQUFYmMVlwz9rXA40CjkIDylrWjxU0OyK0lzRekxC 36S+SUlJKyaumNR5aedFeqHucmqudk76N24yfaEGXoRdi8BNHfzkCPkp2mFEhNsdDseYVkdF 2Kiut3lKqh+m662uitDsUXeVpuhjKTJohYn/d66KsGoRLa4K+SpC+SrCqUU4fyH0AkKmfo+m WaTZEQ70vUFvcdyZiCgtopN0XIJ0XJJ0HK7DcYW67CWivevanCeHq3OMmnuW+eVwtbfMW5EO LdKpaZql9W1omjojR3YnhxHZ5kDTg5F2Wkgr7vKMHTu2sFCZ1eJCNbwiNEerD1u8qDRoaaEm MOlGWd0Vrrlsut5sts5RFcfKfy3KyAlzIq502LFDulL6MtJqibS1+FI5M9wSaZfTWKRLi3R1 KohJTBDJlNLW4hZjBLZGOm8okD9nki/vV0ez0lkR2UmL7DziihFXjL4mY3SG/LcrY1fmsq1P fxzzcUxkhBYZSbelCcnyX6ks/PugIIVu5WzguiEl5aOPPtq2e66cDRyXedT7LfOjnFqUSyuQ xSpu4MNkivhIlW1iNx9dZWXnZWlp287Iyp1dZ6NsWqmVHZ9N/KIgUrSUmFBJEAdFlIMeExIS krPyUvi3bdu2qDAtKiyBHVOyqVxpqTNKc3bKysl7OiXGLNsSZFGKtjZTU2lGTqiJHBq2hIQz oS5yVN0Us2rIqG3bdu3aPjMnJ9npxObBBUPV3xOMgWF87t0mosK1KFtMTEyC1C4Zv5aG2y1R jrS0XbsWm9sll3jBMlNYUxbkZoius3K9c8SoDLc/S0zhjfbr6WN1ehPsfOUOzsaeqmvoThN2 dj7dzL+aqJ5YWOU7If8SYZ3EQBC9p/9yqi4SfjP9Fp2ImHXkXrqz6K7urEjo0tp7mIhgX3Bp 6C4cD1/M7i02JScvR/xNHdep4wZ13KSO76njh3P4MC62q+Nuddyrjp+r40F1rFfHBvlJUJyS R82mjj3UMV4dx6rjDHVMz5yTOUe7Xx0XqeNydXxSHZ9TxxfV8bXWHfF/OmoXeHTgSSs+sOFh h5D/peP/3zMLcYj6r8/R7FPjxXT1k8eAWCleEBvFh6JCfClOsddzKksdIWsbhPzvPVbadVV/ MVb+vdJR5nnhOPP86LR2bci3vS90vP/e0vH+9ICO9z/EdLz/cU2He2anjvfRL3a879yn432P scJpaXcfa2v33ia0gb/peD/kBc4ucrqvSMKeaNoEcFWCJUk8YPmbpUqssf7F+hexN8wf9rzY F37AtlKzup5xFWlvuz6JmKBtj5wR+YjlpsjnI49YFkSti9pgeT9qa1SFZUv0xOhplopO13e6 3rJfaLlrpW223Mjj5ytRDkqvqAHtypBQcZynjI5a2FoKKCspqygVskSLc0uUI9oVPaBTfaic bFeaZOl813lLWuf3WkoXW5eY1rI0VErPUyoo1V3HtCsTzaLenFO6zuia0VpyuxVSlqqy9nyl S0W3Td22d++vyszzlrTuK1rLuu4bWsvnoXKQUt+9oV1pUs/OKTE6tepj9Ji5MXMv/VoWeRUz t4etR0yP6T2W9djWo1wW82lb6VF/vqJk1vc4aZZYV1uRPcd2Vv3rkssn9xzQWsb2nNlaskKl gPJkz4JeEynTe73VazfXb/V6K25K7+lXJquy8MqDlKY+r1A2XjX7qvth9lWFfSf302W5ana/ Mf0yKIF+y/qt7N+Z0ufqZZTnrl579WuhUj5w5aARg/6Z0HXwJkrpkGeH1A7559B7Q2XR0BVD nxt2knJ2eNI1L1y7RZYRM0Y8rkrFyMiRS0OFO+6Xjtyt7naPrKYsHXn2usXXbRrdN/HJxCdv HDB244gZZm3Ou81a496S9cZtG79q/Lrxb93c6+Y1qpTdfESVUxPEhEsm6Def4moaJXXC2YmR E9MnhVH6TzpNvbLJnsmeCdM45sgrytzJBbfYbumtSv8pXaf0oIyYMgYepzw75czUS6bqU/Up z07tP3XF1BU85820NLh36iVTRkxr+qX4lWd69W/Sb9dv73/7MPduzzDPO57alnNKNOXp2WNm J/le9G3wHU/vnN4jvXf6kPQR6ZPTM9LnphekL09flb4x/b30svTqOXPnPD3ntTnNGbaMmIz4 jBEZd2TMzlia8UrG7oyTmbZMPXNUZmLmtMy7Mhdmrsp8J3Nv5heZX2f+Myssq09WQtb0rMez tmV3zu5/vmfZ47Lvz16R/WF2bU6fnOScF3Ia7ulzvmf3zLznn+efh0IzUbvScSbJ1duKnCNy Z7QVc3Y4dyx1HAtmPp935miZPdqVjuM/d1lbkaM999m2Yo5zOQ92arr06+79mUt7jdzNzKfm UXVmzuz8XtQqrHB1qo9ytMx7XWKienVZ2jNLto08Hi3a5r+QNxaqNiJUa2G0q8VL8qmcT2Vd Ka/LUvm8xVNdYrgbwGzsinZF9ZK90WZlp3rOvVRpm+GHnDOzr2qby9vN5i6p989m8KafzeBp 5rzNjG1rmatVP9LqVV2WRgs5G8nZjXiUc3VQzj/mHGPOVsxsMlJZrdFj1pJ3bTHEw7KPhliX en6y50yzT+bTdnOoOUe2zoLnnQPN2VXJnxma9ca2zHc8HdBzZo9yrul/8KbJnm5rzfVEnVk7 uq9gxVjbbVPrihCa6buUdlvbtiqYmSXXGFV7raxB25ndNsk36gm15PMupVGOlmzrvoF3S+mb 9upaPW1bz9qvaFIXtXq1rF9tK9imkHYd16y00Eq1Tq1S5trUn3tTJlJvLutW2P1ztDgY8qzp XTV+urfzZazLHDnSZ2Zke2ZJv/bMkjZ3P9h1THfp/XLp/3ZjcECPeqw6KLOgJRtkj6a3qdsg 67GyTDQx15ZeE9V60K7ItcVcV9TK9P9Y1GrWrpynxlsdS2itay0/b6HWuP+qqFXwwstr/3s5 11OytK6g/6aoNfWCi1rnL7Cc6x21O2hXfu4/tWtoV2Qem5H+78rPe/7P2l1YMf0sdw3Rrmu3 jF81oiKql9xvqDJDPrl2i9xjyLsRM8avkrsP850sw84OOyv3K+ZTtVpUm0W2SXxS7Wnk7mX3 yN1qZyJ3L7tpMYOdQY/QDoIyOUftG3rInYW8V2e5p5B1HjeLrCHrUEJPetTf0lvuUhjnaybn yB2N3M2oUqaerJG7GXVXNjlHziOhdxT2ROtuPiJ3PmonJNQeiKL2P2Fqp0Rduetp2wfdXDay WllcIW2dqpuWXrslpFVXU8MJ01Tfcl8lZF9mv+eMtZ9FrH2cr0w274RNKzXetk41HrHeKjpZ Z4pIa67xsXWzuIY3UcYBLRpijRrtMig19vD2mLBwFbTeahwWGscfhIXjB9aZxnbRSbxsnBFb jDO03UnbnbQ9QtsjWrK4WHOLSZpHXK6liF5aqojS5oiLaDmKluOsGcYmodHvURFG3UjqXkzd SOpGqv6PUus4baKMWvqtpd/P6Pcz7XeiJ/V7U/9W6veifh/67k3fvehtFfp+ISK4egn7uljv NVZY7zN+i30jrYeNJ61HRIL1qBhg/Ur0tx4zqq1BPlVKaRVIOyQcSKtCWlWLB3hzKW9saPsI PVeJLCy+WXQG+f9aXCf/PwmjQnghDfKMOuE3GkQ+zIV5MB8W8Fl2obFD/B7uhfvgfnhIjBSF 8AdYBA/DYlgCS+ERWAZvi/HiHWjmc/BZoQtD6Jr8/Xka+MSvtG0iFmt91hniOuudwm69GzLE YusD4hfWB+EhcXnYamNH2Bp4HirEyLDPYC/sg0qogmrYD59DDdTCATEyvKtRER40doQ3Clt4 E9c/wD+NHTZ8YRvK+XoxyJbIea5RYZsH82EBPGDU2QrgQaPBFoCHhM1WCH8wdtiHi1j7NZAu dPscyIR7xUj7fVDINbbbsd3+FNd/hlVcr4NXxHj7Js74wv4j/MS7M/AvoTssYqTDyfklztR1 vAzviljnHSJW5XA9+e5SWVcvLiVzXydzXyfms4j5LGI+nZhPJ8PiybDfkGGLyLBbybBUMmwS GTbZzCtjuHWGsdx6m7GQ3LiG3HiC3Ei2bjZetB4Wg8kvq7XeOGU9Ju5UuVVDrQOiW7uR8ijy HkXeKuStQl4C8m5AXg7yxiEvBXnXIe8aWt+BrMeRVdxO1kr6f4/+bxUX0esJej1BrxvodQO9 rqfX9fQaS6/96DWDXofS6xB6HUCvfbHiC3r20vNOeh1Kj2sZhbHGPlru4+0OnjwmLqPvUvou pe+F9L2QGvnUyFceupsRkozmbpFH/8Ppfzr9X6/5jDpkJGhP067UeAc5Y5CzCAsWIWs4FgTo /RHrl8YZrDht/dpowpJ4a9A4q0b7aSSdRtK3SPoWSRcjZQBS0pEyGCk3IuVKJPSj9730tFeE MZu9SP5HEd0onpxmlspl7nhGPMSxEP4Ai+BhWAxLYCk8AsugzGgWO2EXfAK74VMohz1QAZ/B XtgH1XDA+FF8AXVwEA7Bl3DY2COOwFE4ZVSK742D4jQ0QhP8AM3GJ+JH413xT/gJzsC/4Kxx RBjMnQI044iaBe8waq13cf07zsnGkbAK43jYZ7AX9kElVEE17IfPoQZq4QB8bTSHHYMgfAMN 8C0chxNwEr6DU/A9nAZ0CTsLhvFu+CXGHvstRrM9CW6FGXC7cdB+N+dk8PI+DXzGu/Z044h9 DmTCXN7daxy33wcPcB2Ah6CQdw9zxvd2fG//E9cr4SmeP8v5z5xX8fw5rlfDGngeXqD/dTx/ lev1XG/i+h2ut0EtHIAvoA7qjR/tX8HXcAyC8A06NsC3cBxOG5X2RiAmdmJiJyb2H4GY2H9C hzPwLzCMPQ5hHHRoxrsOi3Hc4TSOOF7ijC6Ol8kdi1guuqpV0SqWG8e4KiPPy0U4d3KumM/d LLL+I+unor/QeNokxpGZdWRmHZlZR2bWkZl1ZGYdmVlHZtaRmXVkZh21g2RaM5nWTKY1k2nN ZFozmdZMFjWQMU1kTBMZ00TGNLWsm9bfinCrGzzGl9YU40uypo6sqSNr6siaOrKmjqypI2vq yJo6sqaOrKkja+rImjoi2UQkm4hkE1GsI4p1RK6JqNURtTqi1USkmohUHVGpIxp1eL0Zrzfj 9Wa83ozXm/FqA15twKNNeLQJjzbhxTq82IQX6/BiHV6sUyO2Vtjx5Y1qX3Kv8XvW7Vut5eIq 6x5WsM9Y+aR/5S5kLxYeFmHcLeFuGnfD8O8qMZP1NI71NI71NI71NI71NI71NI71NI71NI71 NI71NA4pY1hTr2RNvZLxWs54LWe8ljNeDzNeDzBeDzBeDzBeDzBeD+Bpg/Fay3itZbzWMl5r Ga+1aJrGmjuCMVrNGP2CMVrNGP3C6hF9rOxLWIMLWYN7swb3ZA3WWXfjWHfjWHfjWHfjWHfj WHfjWHfjWHfjWHfjWHfjWHfjWHfjGIe1jMNaxmEt47CccXeA8VbOeCtnvNWyXsaxXsaxVsax VsaxRsYxTmpZJ+NYJ69knNSyVsaR++Xkfjm5X07ul5P7h8n9w+T+AXL/AFEyiJJB7teS7+Xk +wHyvZb1NI61NI61NI61NE5E4PMV+PyvzOjbmdH34PsH8f2bRG8z+T3eWsGMvtc4a90nUlS8 DlH7CLWOsO4ul7O0kU7bXbR9k6cB2i6XOzbaTqZtE+3uYK+03NhIzZXUrKbmZ9TMpNanKkte Uj09xvslav26TeXDM2qE5Rq76Wms0mIfezNZv0Kt99+rYxO7gFjje1aW74VL6ySu0O6ADMiE bMiBeyAX/LBUXCG6sSpVsCpV0PYr2n4lv2OF/NXIfRoJ9WqftUb0tb4rhlk/gC/Z5x4Wv2a3 2ZXdQA92m1dav+b6GLoFRWfrN2KYuEt94+vPsAqeg9WwBp6HF+Cv8Df4O7wIRbAWXoJ18DK8 Aq/Ca7AeNsA/YCO8Dm+A/E7ZB5w/hI9gC2wF+S2zj1nFt8MOKIOd7FbuYNX+nfFO2CdGTdhu +NSoCe/G7g19bOhj+9yosR1gTPeFftAfrobBRo19CAzlehgMN76yXwOjub4exvBuglHj0I0G R0/oBXHQG66EPnAV0K+Dfh3066BfxwAYCPEwCBJgMDxAXwXwCrxrfOXANge2ObDN8S3PjhsN zglwu1HjvMP4StiJ437iuL/lMwqx+4CYXcKng17sIu4QTnbPk6y/43y3mCSiyZBYMiSWDIkl Q2LJkFgyJJYMiSVDYsmQWDIklpY6LefQUqflHNUympbRtIymZTQto2kZTctoWkbTMpqW0bTs Q8t+tOxDy37/dcvhoZbD2Wneyeeau8UAEY6dNdhZg52bsXMzdr6h9r8/yN2o+py3i/e75DcM eZJGHs9Un27kGAmK5WRmkMwMkplBMjNIZgbJzCCZGSQzg2RmkMwMkplBMjNIZgbJzCCZGSQz g2RmkMwMkplBMjNIZgbJzCCZGSQzg2RmkMwMym9fIvEQ2bmf7NxPdu4nO/eTnfvJzsNkZxXZ WUV2VpGdVWRnlbbL+E77BHbDp8Z3ZGs52VoettU4EbYNPobtsAPKYCfsgk+MKrK5imyuIpuD ZHOQbA7a1hrf2TYYJ2z/gI3wOrwBm3n+CefdgByyvoqsD9q+NL4j84NkfpDMD5L5QfsA44R9 IMTDIEiAwUYVo6GK0bCf0bCf0XCY0XCY0RBkNOxnNFTZb6avCZx/a5xgVAQZFUFGRZBREWRU BBkVQUZFkFERZFQEGRVBRkWQURFkVAQZFUFGRZBREWRUBBkVQUcGfc03vnMsgAeMKkZIleNB ni2CZfBHWAuv8PxV6rwG62EDvGscZhQFGUVBRlHQsY9nx6j7LXWPG/sdJ7g/aXznHGGcYGQF GVlVjKzDzjt5lsbnkGYy6xCZdUh9I7Uf9IerYQAMhHgYBAkwGIbAUBgGw+EauBZGwEgYBdfB aLgexsANkAg3wli4CcbBeLgZJsBEmAST4RaYAlNhGvwS7jN+0O6HB6AAHoQAPASF8AdYBA/D YlgBf4KV8Bg8Dk/Ak/AUyO/e/hlWwXOwGtbA8/AC/BX+Bn+HF6EI1gKrmbYOXoZX4FV4DdbD BvgHbITX4Q35/V50/wA+hI9gC2yFj2E77IAy2Am7jHpGSj0jpZ6RUs9IDzDS72PmsDNXXMfM IX9ScF3YW8YPYW/DO/AuvAfvw2YoAeaNsA/gQ/gItsAnIjJsN3wqIsO7CVd4DOdLoQfEwmVw uYi04R/bM5zXcMYHNnzAiKu3receOTbkMNLqbTs4lwF62io5V0E17IfPaX+Adge5PgRfGvV2 ISLtlxo/2HtALFwGcdAbroQ+cBX0FS57P+gPVwM5Zyfn7OScnZyzj+YZeWUnrxiN9XZyxxEF 0dAJOkMXuAguhq7QDboDNjuw2YHNDmx2YLMDmx1XwC9AFy5HT+gFcdAbroQ+cBWgmwPdHOjm QDfHABgI8TAIEmAwZBo/OPww36hnVNc7HqDvAiD/HKvh71y/Aq/y7jVYDxvgI9puga2wjff7 ePYF9esAXzrwpeNbnh+HE7w7Cd8ZPzgZb84bOU8QLidjxXkb17dzvtOoV2tLkBEeJBOtZNRi MuoF9fRbnn7LirOHFUf+1PAT9fQwTw+H6i6h7l9EGE+P8PRIy8/YRLhlojGbz/Cvs5/uGvqJ 5PdigIUZzTIMrjUaLDdwnmjssUwydlpuganGPno8xOx/lNn/qOs5Y6drDXxiBF274VMohz1Q AZ/BXtgHlVAF1bAfPocaqAVmeNcXUAcH4RB8CYfhCByFevgKvoZjEDSCkfewblosM9nB5vKp 7FLLKONry02wxDhsWWocZrwNZKwN5O0e1zPG165nYRW8AC8Zh10bYCO8AZvgHeNwxAr4E6yE x+BxeAKehKf4pBKOZ77BK9IbO/GG3I0fFL9A9mpkr7bcCamQCUuMavSolp+ykL8a+auRvxr5 q5Ffjfxq5Fcjvxr51civdm3mXQl8AB/DTmM1OlWjUzU6VaNTNTpVo1M1OlWjU7W4kagFiFoA 3WqIWgD9GonaaaJ2Gj13o0kNmsifrA5E327MRuF4J4HZKBwPJbCPXyL3IkT0NBE9jXY1aFeD djVoV4N2NWhXQ6QDRDpApANEOkCkA0Q6QKQDRDpApANEOkCkA0Q6QKQDRDpApANEOkCkA0Q6 QKQDRDpApANEOkCkA0Q6QKQDRDpApANEOkCkA0Q6gAdq8EANHqjBAzV4oAYP1OCBGjxQQyYE xE14wYMXPMSiDC94iEeZZSKxWWIkYX0S1o/n08sjfHpZjhcm44VL8MJQvHAJXhiKF4rwwkPE qoxYlRGrMmJVhjeS8EYS3kjCG0l4IwlvJOEND97w4A0P3vDgDQ/e8OAND97w4A0P3vDgDQ/e 8OAND97w4A0P3vDgDQ/e8OAND97w4A0P3vDgDQ/e8OAND97w4A0P3vDgDQ/e8OCNJLyRhDeS 8EYS3kjCG0l4IwlvJOENj7CFPvU9g7XPYu0MrFuKdc+ocbIV32zFL5X4pRIfXIT9F/H2cWzf iu1bsX0rtm/F9kpsr8T2SmyvxPZKbK9Eh0p0qESHSnSoRIdKdKhEh0p0qGSc+PiUOlX+LFLN L13p/Tsx0PIr4xgj9ghvSy3pxvuWOZABWUZV6CdvW5hbtrg+Mt53bTXej/jAOBbxIXwEW2Ar bIOPYTvsgDLYCbvgE9gNn0I57IEK+Az2wj6ohGrYD59DDdTCAfgC6oxj0b+EJEBf9Yk2qHRv ZHwfZXwfZXwfxW+D8dtgNb9sZj4sgQ/gY9hpHEX3RnRvRPdGdG9E90Z0b0T3RnRvRPdGdG9E 90Z0b0T3RnRvRPdGdG9E90Z0b0T3RnRvRPdGdG9E90Z0b0T3RnRvRPdGdG9E90Z0b0T3RnRv RPdG4jDT2I+3y/Dw9taf40iL1ovBWFTM+xrenyAap4jGKaJxirqV1J0YGiVyrggPzRXh5NGz ROcU0TmFhcVYWIyFxVhYjIXFWFiMhcVYWIyFxVhYjIXFWFiMhcVYWIyFxVhYjIXFWFiMhcVY WIyFxVhYjIXFWFiMhcVYWIyFxVhYjIXFWFiMhcVYWIyFxWI4VhQRlzLiUmbxicuITRnaLyP7 95D9x7CiCCu6h8Z699BY34gPXiRuZcStjLiVEbcy4laGVUVYVYRVRVhVhFVFWFWEVUVYVYRV RVhVhFVFWFWEVUVYVYRVRVhVhFVFWFWEVUVYVYRVRVhVhFVFWFWEVUVYVYRVRVhVhFVFWFWE VUVYVYRVRcJOXM5gxSNY8SlWVGLFI2i9Da0PiQjs3Yy9m7F1M3ZJm7rzpgh7NmPPZuzZjD2b sWczOTDXOGuZB4Vc/5HzE/KnMjw9bikkszWOzcyT84xmrvZaFokwy8PU4pOL5UnRyfK08ZPl GeOniHXwMrwCr8JrsB42wD9gI7wOb8CbsAmK4S14G96Bd+E9eB82QwmUGj+h1zzjoOU+ox79 DlkeN761PGWcFrdbco0PLXkwnyxdAA8Y5ZYCeBACUCgusSzi/KjxhWWFUWX5E6yEx+Bp5jjm s4iJxocRk2Ay3AJTYCpMg19CEvwKpsOv4TdwK8yA22Am3A53wJ1wF/wWfgd3QzK4WYk8kAKp 4IU0mAWzAZ0j0DkCnSMegkL4A6B7xMOwGJbAUngElsEfYTk8Cuuw42V4BV6F12A9bIB/wEZ4 Hd6AN2ETFMNb8Da8A+/Ce/A+bIYSKDW2Eu25eG+R8Rle3G95ks+UFvLgFPFvUrnRIBzU+JII NRGhU5b7Zd4InRaHaXFQtcghUiVEqsSSz85xHp6fz3kBLGRHJuN6Py0fYO9UAA9CAAoNg1Wo hFWoBGmnLcuJ2gqjjijWEcU6olhHLlSQr5VEs5Zo1rIilbAilbAilbAilbAilbAilRDlEqJc QpRLiHIJUS4hyiVEuYQolxDlEqJcQpRLiHIJUS4hyiVEuYQolxDlEqJcQpRLiHIJUS4hyiVE uYQolxDlEqLcQJQbiHIDUW4gyg1EuYEoNxDlBqL8DVH+hih/8z+83Wl8leW57/Ena4UkhGc5 V6sdrLO2ddYOWrV2brW77XZLbe2u1d0BPe72cLAOrRRLZVsorUOdyk7VVnf3lg5Q52IEERSM BmJYJFmwSEIgsPJk8YRAWITxPt+VTfen+3zOi/PqvPh9njU+933/r+u+rv8dQxTlQVEeFOVB UR4U5UFRHhTlQVEeFOVBUR4U5UFRHhTlQV11ka66SFddpKsu0lUX6aqLdNVFuuoiWVCUBUVZ UJQFRVlQlAVFWVCUBUVZUJQFRVlQlAVFWVCUBUVZUJQFRVlQlAVFWVCUBUVZUJQFRVlQjK4X wX4R7BfBEfF+URSrkWsXuU6RS0UuFblU5KrxHy/+fxa9HtHryfxMraju3LvD4yLYK4K9Itgr gr0iuE4ES/LkFVHsEMUOUewRxR5R7BHFHlHsEcUeUewXxX5R7BfFflHsF8V+UewXxX5R7BfF flHsF8V+UewXxX5R7BfFflHsF8V+UewXxX5R7BfFflHsF8V+UewXpVSUUlFKRSkVpVSUUlFK RSkVpVSUUlFKRSkVpVSUUlFKRSkVpR5R6hGlHlHqEaUeUeoRpR5R6hGlDlHqEKUOUeoQpQ5R 6hClDlHqEKUOUeoQpQ5R6hClDlHqEKUOUeqYUPVXL6IZL2EhFuFlvuosUaqIUmVsN94ZHSoK I6IwKgqjIlARgap/H6XuKHVHqTtK3VHqjlK3Qt0KdSvUrVC3Qt0KdSvUrVC3Qt0KdSvUrVC3 Qt0KdSvUrVC3Qt0KdSvUrVC3Qt0KdSvUrVC3Qp1R6oxSZ5Q6o9QZpc4odUapMxrV2fVb9Jhc 5md6y+zqjF31mWiStZWsrfRftWOaE+gd+DGm406ftH+sdbC6TplWkmklmVaSaSXZlciuxPoH rX/Q+getf9D6B61/0PpL1l+y/pL1l6y/ZP0l6y9Zf8n6S9Zfsv6S9Zesv2T9JesvWX/J+kvW X7L+kvWXrL9k/SXrL1l/yfpL/w81IpF9iexLZF8i+xLZl8i+RPYlsi+RfYnsS2RfIvsS2ZfI vkT2JfQdpO8gfQfpO0jfQfoO0neQvoOyL5F9iexLZF8i+xLZl8i+RPYlsi+RfYnsS2RfIvsS 2ZfIvkT2JbIvkX2J7EtkXyL7EtmXTHh57LR9Zxge+3n2B8QqFavU7i7b3f20T2mf0jilcUrj lMYpjVMapzROaZzSOKVxSuOUximNUxqnNE5pnNI4pXFK45TGKY1TGqc0Tmmc0ji1xtQaU2tM rTG1xtQaU2tMrTG1xtQaU2tMrTG1xtQaU2tMrTG1xtQaU2tMrTG1xtQaU2tMo0PUvh0ycJ8M 3FftfmM77Gdeu1uuPuhT14Z9IrxPhPeJ8D4R3ifC+0R4nwjv491u5mfUfll+8IEs75flR8ry Q/XNv+7gqdGpmR9Fx+h6o949g4o7/n/s0DHnV3V6y8YeVdc4EmU92uXRLqvdG/2DORbNsUiH Ch0qVZ9oNePsvtTuS60qZ86Hiv4G805Ff1j0h+281M5L7bzUzkvtvLRxwVhWFK2raF1F6ypa V9G6itZVtK6idRWtq2hdResqWlfRuorWVbSuonUVratoXUXrKlpX0bqK1lW0rqJ1FcWlIi4V camIS0VcKuJSEZeKuFQrU2rnpHZOauekdk5q56QTqjF9aCyrhmXVsKwallXDsmpYVg3LqmFZ NSyrhmXVsKwallXDsmpYVg3LqmFZNSyrhmXVsKwallXDsmpYVg3LquExfXdTMaXvaHRE5lnn lMXhtcwrvPWScEtmWfiPzHa9cke4L7MrtGXjkGRzoZg9OAxmj8DpOM9rnw9/GPtv9ROjQ7Jf juIDP7kri9gT7v0nmfoK576Ej1sadmZexTLVdrksfoN7XsEpO0lmVrt2oCRXB6LDjNqZqWAn dhslchqvRwOODpXs2WFT9hyci/PDtuyFYUX8uzAS/z60xX/GMx4/6/pcWBs/j2bPF7suCWm8 FK/ida+1h53xKuSx2vsFr63BOs+70eceSajEQ+6/A5WwKd6JUa/t8jyESi6HI8Om3FF4O97l +btxnMfH4+SwIndu6Mx9GBfhq7gaX8O38G3cgPmhLbcspDnzyrWGnblVvrsWPRgIndFnKLqN omVqrqbmFmpuoebOA2rmqbnigJorqLmCiluomFCxquBWCm6l4Fbqbafeduptp9wGypUpt4Jy KyhXptwKyuUpl6dcmXJ5ym2j3DbKbaNcmXJbKLeFclsol6dcmXJlym2h3BbKraDaBqptoNp2 qm2n2AZKbafUdkptp9B2Cm2n0AYKbaXQVgptpVBCoYRCCYUSCiUU2kqhFRTaRqEyhbZQaDuF tlNoO4WS6MTM3PDdzLOhWSYvpsy/UWY/RYYy3TK6FE3NDITHZPU3MiPhd7L6k3LrtWw2vJqt Cw/I8MtleIcMPy17SJiXPRRHeHxs9L3sSeFqGX9a9ozwueyZYarMP0fe3Z+9OEzLXhqu0YF+ 6Vy8wbm4+nt+T2SvDy+P/ZbCwWZSjVfJbDYYeUhMNhu532hDRkuNlholzR7rdH2663m4MrrQ frrIt+eqdIvtiyX20bKw0loq1nG8O7W7y+vustpd1rtLp7t0musEd+l0l3x0kG8u981Nvvmc bx3uWyuNv843X/bNgm/2+GbBNwu+eYhvrvbNLifvJ4yzRI9Yqi6/iuUy7w1uegXsFRm2Xoat d9dxvpmVPetlz3qZs17mrJc562XNellTkTUVWVORMaMyZlTGjMqY9TJlVKaMypT1IrteZCu5 6u/dZdz1IHdttIJqxs+19hfM5y9YLmOvtL6r7NWF7vm3Wdnj+Ub3kCHusSTcWN0XTgVzKf+s nbAktHilNfOWKOTds1sErgwr3WtldJ2R5vjkNPur16efNuJsI872rS1U2EOFPb69mgoVKvzn HVa7dqArzHe3F2RXW6YcWrKNiMNm2m6m7ebskTgKb8exFDshvJQ9ESeFUvZUr52G00Mf7fuz F0b12Us8vzRsGftpS/W3S776nz/tsk97KT1E6SH7tJfaQ9SuULtin/ZSZDbVq6rMococqsyx V3spv4fyeyi/h/IVe7XXXu0VgT0isIdys0VhiHqz46GoPt4eNscj2OHxrqg+VxNeyjWGzbnD cDisKXcs3gNryZ3kerLPneJ6quefCi25y8L83OX4PL7j+Y2YH4ZEZ4792yvSe3JFn1+HbvRi Q5gfTZC162RsV+aNsUw4l2IfHPuvlV83m+eiTPw8FmN1lNGz/jNTN4tRWYzKvlGnvg2obwPq 28D/kYFlOpTpUK1TZWsvq00DatOAujSgLg2oSwPq0oC6NHAgI8vqzIA6M6DODNS8o+ae0FRz L+7DL3E/HsCDeCg0mdFMmfSALHpTFs2URTMzL8m9hVgs/5ZyWK9iWZgnm7Zn2r2eD92y6I5M Qe1ag7UoYh26w12ZHtc+bMBG9GMzStHVsu6ZTOLxIMrh7swW1xRDYUpmK4Y93obt4Xp1r01H 6NIRulSBq9S/VzN7vLcX+8JLmf2uITRna5BBFrVhSnaca114XGbfnZ3gcRyuUD1Wy/Ar1Mq7 1Mq7soeFn8v2K2T712T712T71/Tqe7PHhF9l3+G9d+LY6Krsca7H44Rwo11wo11wc/Zkz0/B qb5/Gt7r8ftxevh7NfdmNffnojpdVKeL6nQ75bPq7yPZD3j9g/hQuDP7YdcLcGGYnf2I60W4 ONxqN30t+1GPL/WZK8ODB35r7QU76255dYy8Oka9fk69fqJufWiqPwEn4iScjFNCU8OjoWn8 pfhyaIrnhZZ4Pp7T0Z7HwjDTrtsu02bKtJkybWa8zPvLsQIr0Yb26Jh4FfJY7fNrvVbEOs+7 0eN76z3f6Noffh5vxgCScG88GH6lm86Ot3o+jG3YHq6wS6/QYWfL4umyeDpfcq8uOzveHe6M 92Cvz4Vwrx18Yy4Tfp7LojbcaTdfwbfcmzso/Cp3iNcOxWFeOxxiaDdMtxum2w3Tc0f7/Lt8 9t041nvvwXFePx5imDsxNKsAV+jis1WAr6kAN+ZO89p78T68H6fjDJyJs3A2zsF5OB8fwAfD lNyH8BGPL1ZFLsFHPf44PoFP4lPh7tynXT+Dz3r/c66XhTtUmjtUmjtyf+f5F9zji/iSx3+P K/APuBITvf5lXIWveP7V0MVpdHEaXbl/dL+ve+0afAPX4jr8k89+y/vfxneMP8lr13vtRo9f VdWWhZm51uiYnFjnxDon1rm3YF+rHNNzBRqvdS3SaB260eN5r+t699lg3vYzB9OVSzwfRBlb wpToJJXkNpXkBZVj85iTXqYHLQ97D7iaGSrAt1SAl+zu5+3uLv19h509387us3tb7Nq1duvv 7dYVduu9dmur3dpqp95rN15j9z1rl91jl7XYZS/ZWf9qZ+XtnNftmGftmHvsmCUH/u3BzLHf wLxWjVtgZs/pliszzvJmuEKtW6zWLTbLHSryH1XkThW502xfVOc26ZqP672bxzzMao870BWW WUWr2rbTKgrq11orGPyra7WKNZxrv1VUuNd+7rVfDVqrdhTVjqIZ7jPD6m+RLtYdV8b/HhId 8nEd8nEdcqUO+bh9usk+3aRDrrRXF9urm+zVBfbqAnt1gQ65Mm7xvTfwFtpDpy7RqUt02qeb dMuVuuVKHaNTx+i0Txfrlo/bp4vtq6I9UJTzRfm9k4vt52L75fBOTrZf3u6Us2vl6DI5ukyO LpOXO/+bw73W8+vwV6f7HZ+/wXdvdJ0fHpdfC3TMlTpRp1xZJld2jrndH+sqbbpKm9x4k+J7 5cZLlO6i9F5dpY3Ke6m8V46coxu06wbt8uSNMQ9Y8f5O7NKF9nFUkXjXhnYqv07lqrN8Q84U 5ExezlTkTEXO5FX3vOqeV93z8ucM+ZOo2nlVOy+PWlXpVlW6VZVulUutKnNRRe5ShfMis1f1 bFM9q6e0vaKzV3S6RKdLVLpUzTZVs03VbFM121TNNhHoUinbVMo21bGN8ntVwi7VL6/65VW/ LtWvVfVrVfm6VL6iyldU5YqqXF5Vy6tqeVUtr6q1qmqtqlqrqlZUzfKqWV41a1XNWlWxvCrW pYrlRfJ1FaldRWoX0ddF83VVqVNV6lR5OlWZdlWmXUVpV1HaVZR2UW0T1TZRbVNNOlWOdlFt E9U2FaNdVF8X0b2qRptq0aZatKkWbapFm2rRplq0qhStKkVepcirFHmVolWlyKsU7aLepkK0 qxDtKkS7CtHuHF+KDhWJHLVHovPtyFQu3Gr3Ndl9TXZfn5yYaodVxP134v6CuL9gZ5XFvSDu c8V8rpjPtYNSuyYVk6liMtWOScVlqh2S2hVNdkWTXdEkJlPtitSuSO2KJruiSfZXaDaXVnNl f4Vec+lVoFfBLqjQrCDzKzR6gUYv0OgFGhVkf0X2V+j0Ap1eoNFc2Z7K9iaZXrHmF6xxSfip 7O63guc9266a7AiPyl2908pGPOu3spKVlQ78vKBVzUisrNXKWs1uxOxaza7V7EbMrtWsRsxo xIxKZlQyo5LZjJjNiNmUzKZkNq1mMWIWJaeiPpVtx5iD6jZSd7XG0jA1WpvRRozWZrQ2o+0w WpvR2oy2w2httEhpkRp1By1SI+8wcreRu43cTYvU6DuMvsPo3UbvNnqb0XcYvTtqVCd/Y+V5 q+4w8ogRN6t9zapzp+pcUAObx6pz3YFzZo9PDjhLXu4seVb2quicMeV6vFP0Tu9/PdtdvWM0 zrPq6vo82+L+K9x/S5ThkKr/jfpcvrxLZpVpvTsMq8Ej6tqIupaqa6m6lqpbI2rWiBqVulu3 Kr5Dd9ht72fVDvpEJ7tHj3eqXnarey3wiU3U3EbNbT65jpJFKhapWDRG9d+NzbOuP1J0K0WL FC1StPpTgiIlt5rDAnPoMYcec+ihavWnB9uouo2q2yi6laJbKbqNotvMcQFVi+a5wDx7qLuV utvGtOiz1oy1ZqKjzHOnuQ2bW2pu6YGcGraKQfMbNr9h8xk2n2FzGTaHneaw0xyqtT01fmr8 1LipcVNjDhuvWrfTMRWWUmE5BZary33qcp/xOym/2kij6nCf1Vd/O2LV30R3lfnVml9t9d8z qE19alMfBZYbfanRlxp9qbrUpy71qUt96lKfutSnDvVZ+XI1qM/Kl6slfWazVC3pU0v61JI+ taTPWVl/M5MtZlKy1m1mcO+B/95fPSdX/9XhKr2kyxm5W6fvc92g35TDEmrNo9bT1HraGhbb F10Ue0TsO9xpE9Ueodoj1rXkwG+ptYtqL0fYRclHKPmIyPZS8xF7pcte6RLhXutbYr90WWOv NfZaY68o93J2XZxdFxfXRfGnKf40xZ+2j7pEvVfUe6n/NPWftvYlIvCItS+x7l5R7xWJp6N3 UL9A/cKBn4zsGvvJSBTKIlAw47IZl82uTO0CtQtmWTbDMpULVC5QuUDlApULVC5QuGCkMoUL 1C1Qt0DdAnULcmyHerw7dFezKKrx7NfyrfrzgPNDf3Scs9IQX7OJr9mki47qoqO66Gj1XR20 M/tVMfg6H5I4qQ/xITtQCaM63yjfP6T7dfL6QzzJJt5+SLcb1e1GdbtR/n2Ifx/S6UZ1ulGe pfpzyU6+ZZOuM6rrjOaq/7Ks3gxeNIMXD+y837jbiz79ok++GNWYy5boAifgihNwxQm44gRc cQKuOAFXnIArTsAV3iHlHUq8wwDvMMQ7DPEOA7xDmXco8w5lq93LNwzwDQN8w4DuVbLKXj6h LMvWOIlVnMQqTmIVJ7GKk1jFSaziJFZxEqs4iVUoUfUCvbzAAC8wQJFeSuylRC8l9ur/A5TY ywMM8AADPMAAJfZSYq/eP6D3D+j5A5To1fPL+u6Avjug7w7ouQNj6x2mSRw2WMsmaxm1llFr 2XTg599bxj6zOXob77xf1CqiVhG1yoGIrRKxVX8TrYpoVX9y3Ck6FdGpiE71J8UVUamMRWSV 61r0VH/XYSwz3i4mvWLS6/7D7j/s/sPe6TVG0b2L7l1072H3Hnbvopj1uv+w+w+7/7D7D7v/ sDj2GqPqVnuNM2ycYeMMR3VWM5T9UDQu3o090bhcLY6OxlXrvy7zdSus/hvmJTJiQXQ0PXrp 0UeHPjHdKKYbxXSjePaJZ5+79dBmg1huFJs+sekTiz5x6BOHPnHoo38f/fvo30f7jbTvo30f 7fto3xedb5QRWbTNSCNGGjHSiJFGjDRipBEjjRip8t9UOc/zD42p32/0Ed3vY7rfGVaxxirW UKvfjEbMaIRq/X+jWj/nWOEcK5xjJVftb4fhcBj7v6l5tPeP9dp78FdlT/L4ZJ79FNe/Klv0 eB26QWWrGrHX/28qv9tuGBHlblHutp4e6+mxnh5rGZLlI+bZY549snvEPIfMc0iGj4h0t/kO yfLqHHvMsccce8xxSKaPyPTqHHvMsUf0u0W+2/x6zK/HnHrG/r3QKdlrolOih6Nvhoejb+Hb mBKmRT8I34t+iNsxFT/CBu9tRD+2hceiXeGeaDf2YC/2hXtqTo2OrDkN78X78H6cjjNwJs7C 2TgH5+I8nI8P4IP4ED6MC3AhPoKLcDEuwUdxKT6Gj+MT+CQ+hU/jM/gsPofLcDk+j7/DF3B9 dFTNy+GlmsXh+ZpXsARL8SqWhYU1y/E6WvBGWFj7aPhe7WP4DVo9X4GVsNba/QjhnnFHhIfH HYm3R0eOOxrH4B14J96FJHxvXMX7O7E7fK/uXHwUN4eH627BrbgN08K0ujsww3u/io6sWxMW 1kfRkfVnu56Dc8Pz9efhIlzs+achZvViVn99uKf+t5iHQc/L2IIUI+Gx+h0Qq/oQHm6oCfc0 5KIjGw7CwTgEh+IwHI4j8DYcBWtqsKYGa2qwpgZrarCmhnfjWEwLCxvuwL95/AfX11y3uKbh +fHiN57m478SFkb/GB3GnR6OI/A2HImjcApOxWl4L96Hy3A5Po+/wxfwRXwJf48rwJlEX8E3 Q5PMbZK5TWOZe5PO+n3cjFtwK34QnpTNT8rmJ2Xzk7L5ydpZYWXtzzAbP8cvcDfuwb24D7/E /XgAD+JR33sMvwlPinrTuPVh5bhN2IwBJF7f6jqMivd3Ynd4sq4+rKw7BIeCBnU0qDseJ+BM nIWzcQ7O9fmLXT/q+klXa677DibhetyAm0OTzGmSOU0yp+m/MufH4dd10zEjPNnwbFWb6N7Q Ft2HX+J+PIAH8Tv8O/4DT2IuWvAG3kQrnFIjp9TIKTVySo2cUqNVyGM1urAhPKUmPKUmPKUm tETbMYIdqGAndoV56sQ8dWKeOjFPnZhXWwpttU60tQkGUcYWpBjCVgxjG7ZjBNXv7UcI8+y3 p+ovC231X8SVmIirxv59dEv9Na7fwLd85tu4Psyrv9nzabgD0/ET3AX61NOnfg4ewaN4DL/B b33vj67zXBe4voYi1qEbPRh0/zK2IIW122st9dZeb+323Dx77qmGKLTYd/PUwtroEFX/kKgO 9WhA9e/6NmICYuRwEFTByC6S45Pl+GQ5PlmOf1eOXyvHr5Xj18rxa+V49f/KNF6eT5Lnk+T5 JHk+SZ5Pin4SHRzdiRn4F9yFn2ImZuFnmI2/GGcBNoSHRPQhEX1IRO8S0ekiOl1Ep4vodBGd HvGKojpVVKeK6lRRnSqqU2uoWPOvaAI1a6hZQ80aatb8Fo/jCfwbZGCNDKyRgTUysEYG1vwe fwDVa/6EeZiPP+MpPI1nnMHPig7O6CKZ81wvwWfC5Mxnw22Zy/Cl6PDM9eG+zA1hVuZ/oPov Db4aPpe9OtzEBXwue43rTaEl26YfvxUdkV0VHZ9dzb91RI3ZDWFPdiPP1x+dlt3kujl6fzZx HYwOq70pOqT2+7gZt+BW3IYf4Ie4HVPxI0zDo2GSWjFJrZhU2x4dXLsKeaxGBzrRhQLWYC2K WAdayvSpMn2qOjN53NtCm4x/SH2ZNG5HNF5tmay2TFZbJtXJpTr5Uidf6t6Jd+F0nOu981wv hA6qnkyqu9Tjm8NktWOy2jFZ7ZisdnxX7fiu2nGt2nFt3U+i8XV3YobPi1edeNVVM/5UnIb3 4n34yNhum26XPWSXPWSXTa2/PTq4firkVL2cqm/Cb70+1/UPOtk8j5/zeNDny9iCFCPhLrvm Lrtmul0zvV5+1e+C/LJ7HrJ7pts9Uxsy0cEN7wltDcfheJyAE3ESTsYpMM8G82wwzwbzbHg/ TscZOBNn4Ww86V7m1fB7LPF8KV4NbeM/HdoaHwm3NT6GJWFW46tojQ5uXIGVaMNbENNGMW0U 00YxbRTTRjFtFNNGMW0U00YxbRTTRjFt7EYPerEefdiAjejHJmxGCQNIooMnLI4On/AKlmAp XsVrWIbleB0teANvohUroNNOaMNbaMcq5LEaHehCAWuwFkWsQzd6osPjydHBB30hOvygL8J+ 4hRXRtnshrEzwcroRI/qMyerZPHY3xqvQz0aUP3/iTZiwoG/9J7DQTjMGfhwHIG34UgchVNw Kk7De/E+XGDEC3FZSLiAhAtIuICEC0i4gIQLSLiAhAtIuICEC0hUyCkq5BQVcko0KaTR9bgB /wM34p/xXXwP/xOTUf0LQVPCbarpTNV0pmo6UzWdqZrOVEknqqQTVdKJKulElXSiShqrpLFK GquksUoaq6SxShqrpLFKGquksZ5b0HMLem5Bzy3ouQU9t6DnFvTcgp5b0HMLem5B1c2pujm9 N9F7E7030XsTvTfRexO9N9F7E7030XsTvTfRexO9N1GpZ6nUs1TqWdFmz0uo/reBBIMoYwtS DGErhrHN57eHGar6DFV9hqo+Q1WfoaJPVtEnq+iTVfTJKvpkFT2voudV9LyKnlfR8yp6XkXP q+h5FT2voudV9LyKnlfR8yp6XkXPq+h5FT2voudV9LyKnlfR8yp6XkXPq+h5FT2voud58md4 8maevJknb+bJm3nyZp68mSdv5smbefJmnry55s2osaYVK7AyatQNcrpBrBvkMheEzTpCLvNx 18+EH+kK1+kK1+kKcebqkGS+ievDXbrDLbrDLbrDLZl/DokOcb4OcYMOcb4OcUP2f4W7sy86 8y6MctnF4cbsyrBVtzhMtzhGt0h0i2y201lzgzPqRp2kXxep/kW5xOuDqv9NUaxbxLpFrFvE ukWsW8S6RaxbxLpFrFvEukWsW8TcaMKNJtxowo0m3GjCjSbcaMKNJtxowo0m3GjCjSbcaFL7 UEhrH8avMAf/iib8Go/g0TBRB5qoA010dml2dml2dmnWjWLdKNaNYt0o1o1i3SjWjWLdKNaN Yt0o1o1i3Sjm1RJeLeHVEl4t4dUSXi3h1RJeLeHVEl4t4dUSXi3h1ZLaHahgJ0axC7uxB3sh t3S4yTrcZB1uig6X1+FmcdQFjrrAUSccdUHHmzguDSlXXeCqCzrfFJ1vyrhRr+3C7jBRB4w5 7EJdQ0jrxqMRExBD/dEZY+67wH0XuO8C913QKeO66r9OP97jE3Cyz56C0712pudn4Wycg3ON cZ7XL/D+ha4XRYdz6AUddaKOGnPpBS69wKUXuPQCl17g0gs67RSddopOO0WnnVL3A9//IW7H VPwI08Jtuu9tuu9M3XemrjtR183ruvm6/4ga6xZCjjsLNuvC+bq+qFEnzuvEeZ04rxPnnQ+b nQ+bnQ+bnQ+bdea8M2KzM2Jz/ad8/tOuaimvnPDKCa+c8MoF3XsGr5zwyokuPksXn1X/HY8n 4fowmWdO6m/BrbgNP8APIXd1+ZifTvjpAj+d8NMJP53o/LHOH/PVCV+d1MvVernKXyfcQMxj Jzx2wmMnPHbCHUzmDmLuIMdrJxzCZA4h5rcTfjvhtxN+O+G3E3474RxmcQ6zOIdZnMOsevlX L//q5V+9/KuXf9zELG5iFjcxg5uYwUVM5iJmcREzuIjJXETMReS5iDwXkeci8lxEnovIcxF5 LiLPReS5iDwXkeci8lxEnovIcxF5LiLPReS5iHzDrVFjw22YFpqdg5u5ipiriLmK2Hm4ueGP 3vsT5mE+ng0Jt5HnNvLcRr5htde2+FyKIY+3Ro0cSN6ZuXn81VFj46/C5sY5aMIj4Tqu5LrG 33q8MCSNi7AYS8ItXMotjcs81kO4lRy3kuNWctxKjlvJcSs5biXHreS4lRy3kuNWctxKjlvJ cSs5biXHreS4lRy3kuNWctxKjlvJcSs5biXHreS4lRy3kuNWctxKjlvJcSs5biXmVmJuJeZW Ym4l5lZibiXmVmJuJeZWYm4l5lZibiXmVmJuJeZWYm4l5lZibiXmVmJuJeZWYm4l5lZibiXm VmJuJeZWYm4l5lZibiXHrcTcSsytxNHR0S/CJ/7mLzYtrnknvh5NrPlGdGXNtdHtNddFH6v5 p+iTNd+Mrsx8Jro6c/3Y32/7RPaq8LHsgvC77MJwebbPGWGD1zeGNLsp3JMtheXZgegd2SS0 ZwdDJTrOKOOj34fOaGnoNNqNRrvRaDcb7WajfdZopxvtQ0Y73WhnGu0TRjvUaAcZ7cNGu9ho 3882hwXZl7Bw/2D25fCcftOZfSUszS4JvzCLGWYwmu0Pm8ziw2bxC7PImsWvzWJJ1JBdEZ7I tpmbE3q2PfxTdlX4SzbvWx1hrQ5FK3N8zhyf88mv6GMrffpBn749275/v0//xqc/q6c96xu3 +sac6PjoF9H5NbmovuYgvBym6a7v0k0/mvm8s5bKkPmuDjs3OjGzJFyaWRYuz3RH52d2hG9m L3Z+ao5iXfMMq/iz0ZY7Z2Wz7c5Qq8MzuuY4I+y3qtU65+0HOmf2wFkra3WbsgNWlnh9MGyp OS2qDQuicahDPRowHo2YgBg5HISDQ3N0CC4Ia6IL8ZPwWnQnZuBfcBd+ipmYhZ9hNn5Bx7+E ddGCsE4c14jjmppDcCgOw+E4Am/DkTgKb8fReDeOxXtwHI7HCTgRJ+FknIKpoVjzI0zDHfgx puMnuBMz8C+4Cz/FPWF9zb24D7/E/XgAD+KhsD5zVng+cx4uwZfCoszM0JeZFfpk7j+M/V3N jWN/W3M+Rcvy5YvyZW+2sr+U3Rk+nh0NDdld+3dmd+9fm90T6rJ792/O7guXZPd7PYS3147b X6qtCx+vrf5/+hr276wdv39tbWOoq52wf3NtHC6pzXn9IJ+7KSyo/T5uxi24FbfhB/ghbsdU /AjT8KewpnYe5uPPeApP4xk8ixdCsfYvWIAX0YyXsBCL8DIW4xUswVK0h9dqVyGP1ehAJ7pQ wBqsRRHrwmt1cqlOvtTJlzr5UvdO13fhdJyHC3FRWFN3qeuDoVj3GH7r+TxX86kzn7pXPX8N r3vcgtUed7jabXVdKKAX68P6uo3e24E92It92I8Q1tQfHYr1x+AdeCdOCOvrT8RJOBmn4Pbw Wv1UyNV6uVrfhLn4Q1hX/1x4rSGDfw7FhslhTcNNrve7PuD6aFjf8KT3fLbh9+j2Wg/Mq2E9 hkNx/KVh/fgv45qwZvw3wprGJ0Nf43w8hWfwHBagNTzfuAIr0Ya30I5VyGM1OtCJLhSwBmtR xDp0owe9WI8+bMBG9GMTNqOEASTh+Qn3hL4J9+I+/BL34wE8iIewOCya8AqWYClexWtYhuV4 HS14A2+iFSuwEm14C+1YhTxWowNdKGAN1qKIdehGT1gUTx77N/+LDvoi7L2oVt2dr4om2dXq XmfYG13p/DjH+XGO8+Mc58c5zo9znK9anK9anK9anK9anK9aVNe05rVQcM4pO+eUnXPKzjll 55yys8vDzi4PO6u86azyprPKm5knwi5VN6/arv/r705kj3Y2WRzmOJm/W23vUWnv4/3n8P5z eP85vH+Z9y/z/mW+u4XvbuG7W3jrOfzzHP52Di87h/ecw2dW/4pfmZ+s/vW+Qv0Hxv5OWZmH LPOELfxaC49W/blm9eeZLXxPme8p8zrlhv/N3HXAV1Fs/TMzuzN7b+4mBBIINbQQWkCklxAs IIKAqCC9KBYQy1Msz6fi8+mz1/cEC+oTKyhgAxQQQQREqQqhlxADCS1KDS3z/WfuTSgBAsHy 7f5m7uzMmTmzs2f+c87s5mS6Xg1dxnjb2xHoo1dDX3kF+sor0E8WQj9ZGJqjD4a+Q5iLsE3/ GspD0PpX30eojFDlpO83Cr7bmK8P2u80OFDtY6wPT1KMmEYtxXTqL76hJmIWJeD+p4hvsTrP oWSxmLpiLLrCXnOx8oRgs5USy6kRxmUDVqBqWDM3UyrW9gDWna5Yd5JFNnVAu3Mie331wWk2 OK3QoyzP3SgbhtXJ+AlcAa0gRy8mxoZSGp78EtMutUZrVwBnL0fb4ZxGQOEDyL0YKLwTKLzb en7crg+ixUxwyaEWdi8lAbS17N5KI/SmNrg3wNUSao6el0eZi3vogX730ovECNzzbD3bSbX+ 0XthbZ2tF4IamAS9IRdX63A1HNrFLKzDs/UCSiYHvXQRJIJC8BACCEGEKIQQgo8QTWmiB8XD Dp4MG3gyWkmF/bsELa1ESz/Bnk2DPZsGezYN9mwa7Nk02LNpsGfTYM+mwZ5Ngz2bBns2DfZs GmyyNNheabC90mBrpcHWSoNtlQY7Kg02VBrsJvTF9nWa3gtO63AXW8Q3kN5ZejU4ToYGtB33 PoLq41nHo3SvuVvcezSVZkupJltGDTEy/a3O1gdUfamvGGD9H/YVw/VcWPALxD06Q4yiZmI0 wjQ8h+lUCyvkBKclNXKM93aBWkmokQQ+jfE0R1A1cNpppMlycjGfVkNX2gE96aB99unmP70h dxeucq32tQNPKwYI8BNojgAFjqBkl6Ezmg44LMbTXgIJXAFcgHTo31A7F23uxBMugzr7UTI3 Qp9nWgTXJchdipaX4a5/Qt4KcA9THLEURsokKPaD4khYxo3HVbS7Uh+2vVoKila2nz9BnzKl y3U65CkOWt5hcAi34UVa3yJWmjcStp9LcbVMb0e9w5G7zkTJZqqOmZALGQ1ixlTAjCmFeTCD GOJc6+08D1KeL8w3TgLUHig5rlbj7s1VJvq6BSVb0UYOdM5tKN1ufDlgnuSj9CBazw+3jnmT jdZyIPFGzzb1S4HiQITC+FL1ULrJeu5Hz/RCzJ7kcClw2JRmgy+3reXoLXYOm/aMn/A8jPtR vRG6zU7oMuYd+FGdi5R5lvtBdRjhCEb9qF7iuDoPek+eE6X3gmKJpf0JKTNmh3B1GByPYlS1 zncCxEGbj9J06Eb56PF+lB7A08nDczyIFsMtmxorUOMIWs+HlnUEPdnheOAQ5mRaWIEWjuCZ HsDo5mG8DqLWYa1RM9vyksRQKxe18lFLo0a25VkaPDOE+d8MedD9D2LED+nltpdHMIvzdY6t 7eoMtMDRwlq0sN8J6OW251F6JTS7HNuSRAt54LdB5FvKPPDY4Ph2vPMgH4fsfaxGyRbUN31e TdFOHAWcePQrAXUqUCkHeo1TiTynMtJVUJaIsuooq4nrJJTVQlky5M5xyoJDRZRWxW8SnkXI icNVvN7llDNtgUNFcDJtVUF+IvKrmXaQn4R8tEPSUidQ0LZjKKojbdoqjX5xlGY5ZZFTDiGB EtG/0qDMQpuJ6B9H/zhqZTlVUV4NoTrya4ImCXm1kE42/3sQraxDX8N3WB59rUBupBVTex36 H77DGiiribJwbY77jUOIh8yVRZ8T0G4F3EtFvQc1g+CP+0J5Isqrorw6ymsiLwnltVCejPvD XehtaCEPLex1yiEkQNLKg7oCnmclPMfKuOcqoEkETVWUV0OoDpoaoIFW6dQCTTJmp3lOITuu CRSHfpgRy0M/4tCPKPQjZMe2Oq5r2hHMQx/i0Ico81RIRJ5ueJzDvTejJyJP1o55pNcc69n+ /BzMgoGQmkqQyC6wOXIhke1hc2yDBA2BVCZCKlvD5sjBbBgIiaoEqewCmyMXUtkeNsc2SNcQ SGYiJLO1E5d/CKOQglGoh1FIcRLy8zAKKRgF8zwvxEgkYyTqOFVAl4j8qqCrht/qoKuB35ra PNMLMRrJGI060AFgQ2JdSIMWEQ3toQyQ0dirSUCPFsCMeVgHYsiHTbgEtv0S2PZLYNu3hm3f Abb907DtO8C27wDbvgNWozGiJ7D8WtjyvfQYW2saak1DrWmoVaeYWnNtLeMze6XNLbj6pPCK s1is6ClE1ArrZ126COcF1JmupkbUk65Fbm+6kdrQzfQMdYIVP55up2k0E1fmfwK/SD9QOr1E q3C+RZmURf+jrYzRO8xn8TSTVWQVaT6rwlLoe3YF60KrWDfWjdawPqwfrWUD2UDawAajzxvZ cHYbZbK72VO0hT3DXqEj7DWcATYGZ5C9iTOKjWPj7X+1X8Ki+QX8QlaFN+HNWTXeirdiSbwt T2O1+CX8Ulabd+AdWF3ekXdm9XgX3oU15N351ewC3pP3Yo15X96XNeMD+UDWnA/hN7AW/CZ+ E2vFh/LbWGt+J7+HXcTv44+zDvxJ/izryZ/no1hf/gp/lV3P3+Wfshv453wuu4vP5+ns33wV z2SjeDbfzsbyXP4re59Dh2Yf8oP8MJvItSD2qeBCsM+FElFssvCFz6aJGBHDpovSojSbIcqK CuxrUU1UZ9+KmiKJfSeSRR02T9QXKWyBaCgash9FI3EhWyiaiGZssWglWrNlIlW0Yz+Li8Wl bKXoIrqxNeIa0YutF33E9WyzGC5uZTvEneJetks8IB5ge8VD4iG2T4wSo9l+MVFMZHniC/EF OyimiqnskPhKzGGHxWKxkmP9E9s5VhuheQXHdaJ5TSfOqc0bOKlOKr/EGeE8zi91nnLe5r2c ic5kfofzpTOT3+cscpbwkc5PThZ/xMl2NB/lRrvRfKJbyi3FJ7lxbln+ibvezeSfu1vcbXya u9Pdyb9xf3V/5bPc3e4ePtvd5x7ic9wj7hG+wNWS8R+kkIIvkq50+WKpZAxfImNlAl8lK8gK fJOsJBN5hqwua/MsWU+m8h0yTaZxLS+S3QXJ3nKgiJU3yWdEgnxOviDayv/Il8VF8lX5qrhU vi7HiPbybfm+uEyOl+NFFzlJThJd5WQ5WXSTX8ovxZVyuvxadJez5CxxjZwr54kecoFcKK6V P8ufRV+5Qq4R/eR6uVlcJ3+Rv4ibZbbMEUPlbrlP3CIPKxK3qyjli7tVeVVP3KcaqVbiadVG tRUvq/aqo3hFdVadxRjVVV0l3lA9VG8xVvVT/cQHaqAaKD5Ug9VgMU7doIaJ8eo2dbv4RI1Q I8Rn6h71L/G5ekw9KWarp9UzYp56Ub0kvlcvq1HiB/WaekcsVO+p90S6+kB9IFaqcWq8WKUm qUlijZqi5om1arFaLnaodSpD7FHb1VFxUGnPdUKe8oJOGW+4N9wp593m3eEkeCO8u52K3r3e vU5l737vfqeKN9J72En0XvJecqp5//Vedqp7r3qvOzW9t7y3nGRvnDfBqe1N9qY6Kd4sb5Zz gTfHm+M08uZ73zsXeou8JU4Tb5n3k9PcW+GtcFp6q7xVTitvnZfhtPZ2eruci7zfvN+cS7y9 3l7n0kCLQEunfaB1oLVzWaBtoK3TMdAp0Mm5PNAl0MXpFOgW6OZ0DvQI9HSuCPQO9HW6BgYG BjvdA0MCQ5xrgq8G/+f0CL4ffN/pHxwfHO8MCE4MTnIGBj8NfuoMDn4e/MK5LjglOMUZEpwR nOHcEJwVnOXcGPw2ONe5KbgouNu5JUpGRTsvRlWMqu68FlUzqp4zNiotapAzPmpoVLqzMGpV 1Fa3VdSRkON2CsWHWrhXh7qEBrj3hv4Wetp9MvRmaKL7bujT0BR3cujL0DR3emhGaKY7MzQr NMudHfo29KP7bWhxaLm7MJQeSnd/Dq0KrXGXh9aFfnFXhraEtribQttCuW5GaHdot7s1tD+U 52aHjvrkbvcDfrSb65f2E9x9fmW/invEr+pXc/P9Gn6SJD/ZT5bCr+M3k47f0m8rS/vt/Itl gn+p30FW9Dv6HWUVv5N/hUz0u/pXy+p+T7+frO0P8AfIhv4g/zp5gT/EHyYb+8P94bKVP9ef K1v78/0fZRt/sf+zvMhf6a+Wl/lr/XWyk7/R3yiv8DP8DNnFz/S3yq5+jr9TXh3dMfoa2Su6 V3R/eUP04Ojr5S0xqTHt5G3EA7PMf0SO2h1LVJsS6Xc59Fa9laoiEHToU5Xn63v0OP0xUg8g XKs765n6PaS22dLNeg3iTRHafUVqbzNB78C5qzAzpmgfEO4rtqedET457nqD3kDQgc9YZz/C ar0HyRDW7d6w60lnFZbmFqayT1F3vt6kt+uv9Sr8LtY/Fte/Yg8Pbc4Jc8P5aQHPY70o5LwT Yb3eiFHL0z0pQC70imqFpfnFMdK5eq/eg/HJKMxSyLVX+iP9EUbNPMG1p6xreGeBe65ej0uX ghizVKTqRHq+jFoikAmnrD9Sm281SA9AaKsb6rv17SeM9JbCVBH+kLUfII/ZeqH+EX3YpReT jJTknES5qNgx2GB7b1JfRMZku54Kaz5cuq4I/X6cefqwXgLK9ua/tEN/c8KyaUck65jkhGX/ hNpZOlObv7Mi2K/merH9j+mQvUKKXSfXOU2/TxgV/cFJd3R2R/hZ7bfxL/oX8hDOzPUwwsHI RUNqfkba0fpDxDv092fdn+Nrb9GfId4bHqcTSk6JPydQHNBfGdlCapaR0xPKehVb+zeEzywi rT65dvGHfslIkx5/ylnjnUX9XD3NPo0d58q5oP4xnD3nus9GfueVoO4MG6885YjJkvUnctQs lrdZF8z6chjza/s5th46Y2lthKssjzAqZoTPSOmp1tY6OBNx1jmhh+/beEn4PEPtRqesvcfG WIH1kaKYUkiVr3OAiTmYcQXjYVcA/a6NVwMzNwBvzuLQo6gccKkJXYn0lzZnN1bn7NPzPqH2 C1hFYugyGoS0nfuou03/dqq186SaZhUeg9oBKkt3FebO0dPJPf26WmSmuLjvm5E/wZaaNeJw AY7rI0VqHz4u/QzmbnmqTk8hfYnN+QZazPd60ml5Z506Px989BTdUbfXQ/RlEdq3itR+JPJ7 4hrJqT/9C3Y/0XP0PNbVF+ljSOlEmgppnE4z6UK7I9CM5lA6EHg1ZVFnuxfQiw1ig+guWOBX 0Qhje9M9xuqme/kwfiv9HfbzKnqQr+WZ9BCs6Gx6nG/j2+kJY0vTU3w/P0DP8MP8MD1nbGl6 3tjS9KKxpek/IlEk0iuin+hPr4pBYjC97kxxptAbsEI1vemWdcvSQvmN/IYWyfnye1oss+QW WqqCKkg/GbuLfjZ2F61SfVU/Wm/sLtoIu+s62mTsLtps7C7KNnYXbTN2F203dhcdNHYX5cPu GsUIFtcYJtWb6h0WMHYXizF2Fytl7C4WqyaqSayMsbtYvLG7WC3YXUdZCiyuIOvmRXulWF+v jBfPBngJXgU22KvsJbIhXjWvBrvJq+XVZsO8ul59dqvX0GvE7vAe9R5jd8HK+ojdDWtqMbsP 1tQydr+xl9g/jA3DHjA2DHswanZUOvunsUzY6FDP0AA23dgS7DtjG7C5xjZgPxvbgK02tgFb Z2wDttHYBmyTsQ1YprENWI6xDdivxjZgvxnbgO01tgE7bPR+dsTo/eyo0fs5j+4W3Z2r6L7R /Xkwpm1MO272dldaiWFWYjgkZhR0ktH0GuT5dXoXOe/hVPQ+jcca9BHkSVp5kpCnGZhtX0Oq glaqgpCqBcj/gZZTFK0g46spHacPOVtH0bSeNlNVu/9UjbbSb5jnu3FWpz10gGpQHs6adJCO UhLlQyJjrURWthIprESGrESGIJHDqRS/FXIZsnJZGnK5nsryDXwDleEbeQaV45v5ZkrgmZDX SlZeK1p5TbDyGm/ltYKV1zJcc01lBBR3ioPUcsQ4KB6yq5D2hEflRQByHGfluCLkuB/VEv0h zcmQ5kFID4ZMJ1uZrgyZXk/M2eBkEXe2OFtJOtnOLopycp29VMXZ5+ynGOeAc4QSnaOQ/iQr /dWs9Fe20l/ZSn9lK/2VIf1dKU51U90oSl2priRHdcd8cDEfeiCnp+qJnGvVtaRUL9WLPNUb 86QG5klf1O2H2RKwsyXK7FKQr67DnInGnLmRqqmb1M0Uo4aqoZSkhmEWxdpZFGtnEcMsuge1 7lX/AM0D6kHkPKQeIq5GqofB5Z/qn2j5Ecy0KMy0f6PW4+px5D+hngD9k5h7vp17zOx5gOY/ 6r/g+7IahdLX1GvIeV29jlpj1BjQvKneRs5YNRY9eUe9gxzMTwqa+Yl2xqlxqDVejUf+RDUR 7UxSk0A5RU1BzlT1FepOU9MwDtPVNxiZWeo79HOumosxmafmoVeL1VL0dplajjbXqY2g36Qy 0PJmlYXWtqhtVFVtV7swJrlqD3jtVfuoutqvIJMqTx2kmuqQOgSOh9VR9FkrTdU8o4zV8JjH KMnjHicGMXEo6LmeS74nPUnRnvIUlfFwUMDDSbFe0AtSlEETqmzQBDHQBDHQBDHQBDHQBDHQ BDHQBDHQBDHQBFwWeYsQL/YWEzeYQo7BFGIGUygETPkW8ZzgXCplkIUEkKUShUKVQ1XIDyWG WlApgzLIB8pQeaBMHSrj1/XrUpxfz69Hvl/fr09l/RQ/BaUN/AaU4Df0G1Il/wK/MdJN/Cag b+o3BU0zvxloWvotkW7lt6YKfhu/DWhS/bagaee3Q+lF/sUUBeRqj/wOfgfkA78Qd/I7Ie7s X0GlgWJdqZzfzb+S4v3ufndQXuVfDY49/d7I6eP3Q8tAN3AZ5A9CPNi/DjRD/BvQ5xv9G9HO Tf7NSA/1h4J+mD8MaWAf8oF9yMn0fwGXLH8Lam31t6LlHH8b2tzu76R4g4YkDBpSKYOGVAqI NSGChi/gFIVo+ArSrwMHhcVBFyj4MdIT6UvEX9E0i4azkP4WGChoLnBQAAdXADfTga/C7r0r i4PC4mCcxcF4i4MBi4NlLQ6WsziYYHGwvMXBKBbDYijE+rA+iIczoB67nd2JeAQbgfgp9hRw sDvvTtyipAeUHILYoGTQoqRnUdK3mFiG7+A7gJ4GB2MtDpbmR/lRirYIGCMc4VAssM9DOiiC VEr0EX2Aen0FMMViXyWLfVXEADEA+QPFQOQbHKxkcbCKuE5cTxUKcXArCSDgXlLAviMUsKhX 3qJevNlZxSztorqQsOimgGs9ERtEExbRXIto5VQf1Qc5BtGEGqAgwcC1QaA0WBZvsSxgsaw8 sOwWzPBb1a2Ib1O3gfIOdQfiO9WdiA2uKYtrgQiujVQjkfMwcM21iKbUo+pRi2uPgd7gmgKu PYV0GNGeVc8hbXBNWVwTFtcCarQajVqvqFeRYzBOWYyLimDcG+oN5BukUxbpyluME+pDoJuI oNtH6iOkP1ZYX9UENQGUBu+Exbvyx+GdsHingHdzkTYYp9R8tRDpxWotYoNxChiXhbRBtziL bvEW3QIW3cpadCtn0S3Bolt5i25RKl/lo5bBuHiLceUsxpWPYJwClgmLZVFeyAshbVEpODP4 DXnB2cHZiOcE51AwOBcYFAzOD85Hzo/BH8mzeMSjVkVtJG6RpYzfGJgS4zf3W1CsxZEYiyBl gCCpSLf10yga2HEpcgx2lPIv9y9HTme/C3DK4EWsxYsyQIpeSBukKO339/uDxmBEGf96/3rk 3wCMKA2MuAktGIyItRgRYzGilMWIWGBEJtrM8rNQK8fPAf02oEOsRQdOvG4ps0fT4LMWV1E7 uuZ02vz/50Nvgt25JbxPpDcW3RWJWE+n3KsrpuUMvVbnWntxjt1/WGNzs+xOwrLIvqxpO9Na kRl6uV5uKSK89M9nbD2yj6eHnnvPfr9Dd9af298iO8+npN4EK/27s7N2z9jOLyemMaa/FOwK 6kUY1VUYzfV6mV5ZSHXs+cUV5i3Tu/QSaOAJqBGxFMO7jX/KESzsx/H7zyHqHc4rsr+2Jbxb cULeLv0z7jW3YFf19z3Cu116VYGsHc//+D6jF0V20E83l36nnp3zbNTv6rft7xH0doENo/U4 /P4QKY/sddjdyX16aXH7tafkkal/gSRG9rDCKbM/Urhr/V+Ubw/vUOvNoF4QGdcTeOkDZ8Hp QMG+2e976L3H+qL3Y6z26UN2Z/qE3Z1z3gn8C44CicTMzjkzZQHdH9iXIu86zkj9mZ6sPzF7 9FRWv6Un27xNeqH9XV9Idca14TQtrwRa5OoV4SeI1Co7d9fY9Wi8pdhlSxabnWqcWyO7jBFe dgZVpEsiV9/oH/TXoChPnfD7rc37ILKCPYzQ99x7eMbeh1foTwqvB+ux+jb9hH2T9o/C3NbI A43+7WQkx3ws8oyxAs/RP5pV+nfu6347f6zkGYQpOs/1rmP742eW0HOTnj/gsG+L9Usnvx/W 957qbYbeAMzILKG+tNLUsmu2H7622X5BrB+yuQdJhN+sFdYzvKLpgpNa24X2dtk2XPxuKsi1 sXmXmH7uPTyh/cLncnxLkbePWZFZtDjyTvIEybP4n3vy20Tzjv78enSux8nv+4ru4Ufynzpl bgme8Nke+vFzIK5iazypH7S/5i3zFxjLL4Cj08xvpMWC9T38Tjbz9G8eztCrCXoS1uyJkasF +qPI7F6AsNDqGAeM7Ef6sUUvjMz7MK+TvrrQ36KHsy3OpwCFPovkfncCjTZoXYKerqDj33yH kTPDyp1tLyxrtt+LLO3Sglpk3kgtteh6s72apefrv+nv9X36Hf0asDKCtOEakfR+jPTdJejl CH23fkPfgdSPOhupvyH1LKygN/RUjMxYfQtQ/C3kLbej9YX+X1hiI7wqhtecwtaydTrw3MzF Jli5InMyYhMYHeaQTZ3ze2c7WjuPR+mCZ2zTxrqL2D6Wy0bzNi78Ri7CK+XYk/izjuO/UDG9 w8jsKWaVMVKw94/uVxGuujC13+q0K/GbecYaswvmcAk5vqH76JF6tE0vgryM1TNtekt4Lhvd SD+K8GnJedhWOup/nlf9TL0Twa4RkD+DaoXWVFhbwZq2FuGstNsz8Fle4prLIm/PM+y3aRvC X69YjDEr3qYI1Z8u+ycfepi+Qc8t+PJI/wN6yw9mz8Rqv5N1Hsqe1Q/qFF1Hj9epePZ/P2Ur rxbLJ/yNR/Xz7u/rJ1x9dr7tnYbLf8+zfhZwOj28rmLWrilSvgW52/SKYzswf82hl2CWZIZ7 AW1s9SnWxdWQgIySz4Pf50Afnqbjvg/Cejfjr+xP0QN21XPh3RF7dT/mztYwdhbqD5thBz6r X9QHoQmtPfVXKcWP8+m+a/x9D4v3kArM//Oy/Qq/OfoDDr35eD7ntzrrC8+3N8W0vzGsF2E8 z2tFOv+94WI5bMHKWuwXU3/1cWYt6ByOIt96nyX/InvNZ1Fnl6l1rObZzqyS8Pqzj/Pd8yzJ ewXYElsjmpRb0EbhTn/o9KNreZWnO8w35+fMsyT73jnH3r4U8g9/L3u0WF6cLjt3jn/JUbYk lQpWyHOqM9vUOrb+2++Wd8IyKmbPtyS8/pgD9ube033BeRzVedhxv9sRVUx5Wep77E3dX3GY 9RQzbO2Z/37Bvmf6k+33s/2LitPUnhb5zYiEuacgqmO/2I4rmZ5lvwnPKKgZTtlQ8MV5mGNr opO+Cj+BV8FeZGHt90/RG/NleSPz3XnBXZ1TP8foaTjfj1zZlH2HMS1yF+EeNCrSzxLwKqxb Ai0bFr/5aqFwt9vqz/tIFrdvHeH1B2ugpzyO/xuE8CzmxdRQlGo+9jrXo0TvOzbb9x2Fmp6d BduLn1cRXpVPyl2K57NU/0DlqI6eF9kpnRvZQYIE6SvPvYdn7MV8G08uvO6l74ON+LL56wB9 W2HuJfr50zTgnqLNnWezbpTksLpT2HLdrVdi7i9FvO64NXYH8n8ls293q73+HIjbXy/EXc3H PS3UN0ToXjuh1XX6qhL0pbe+Sr+pr45c2ZQeZlMf6/f1CLs7NS38fPVUnF9EnqLhVZYa2jee 9+vhNs98z/AmLPE39Sd46lnmnYTNP2HfRR/WY0rQz9FApjkFd4zUOMTmL8/M10xZepL+EE9r ti20f39VYNtHeDU5d45/9lH8X3KeN4dt4fmKJ3CweOqzOMoDn8pTRTPakFAEXFXBPF+I8weE dbop5lw/itFJJ/SjS34YNSJ/xapn6KUW58xfWJr3+hE78dh8LnInX9v4fmBqRZtqpvuAV1fM lzK65QmUIxH66h6YO/YbAODSBr1GT9DvQla36dyIpVCPki0+17c0s899KPQ30JQLJNB8uzIb 54ZjepDuY3/6UE9qSS0sr3on89KxmnRlrYAGc/SjejrCSP0v+zut4N1h5Ii29PeUoJ9363v0 c5H35yGk7sL5LPKfs6WfalgWegqewDFb3S8pr9/p4EXSxa2JCnqUAO3cYnyx9In4YnmELrce VoawKqwe3Wp9q/zD+lZ5kPVn/ekhNpQNpZHWq8rD7EH2FP2LPcNG04vGqwq9YbyqkPGp8ia9 Zbyq0P/YbLaExvILeCP6lDfhzehz41WFpvA0nkZTjVcV+pJfzjvTNH4nv4u+5vfxv9M3/AX+ H5rN3+Xv0lz+AZ9I8/gUPpUW86/4V7SUz+AzaRn/js+l5XwBX0DpfBFfTCv5Ur6MVvOf+c+0 lqfzdFpnfKLQelFKlKYNxhsKZRhvKLRF1BQ1Kdt4Q6Ec4wGFdojWojXtEqmiLeWKdqId/SYu FZfSbtFH9KU9YoAYSPvsd+IHjJ8SOmj8lDDf+ClhSc5UZyZLMX5KWFPjm4S1ML5JWEs3zo1n rdwEtzJrYzyUsIuNhxJ2ufFQwroaDyWsm/FQwq40HkrYVcZDCevlaumy3sYrCRtkvJKwocYr Cfub8UrC7jReSdg9xisJe9B4JWEvGK8k7EXjlYSNNV5J2DjjlYQtMV5J2E/GKwlbYbySsHTj lYStkuPlx2yD8UrCMoxXErbZeCVhmcYrCfvFeCVhW41XEpZtvJKwbcYrCdtlvJKwXOOVhO0z XknYYeOVhB0xXklYvvFKwrnxSsI945WERxmvJLyK8UrCaxuvJLye+aKcN/R8z+cXeLFead7I K+eV4429il4l3sSr6lXlzbyaXhJv7tXx6vCWXorXgLcyXkN4G+M1hKcaryG8nfEawi82XkP4 JcZrCL/Ue9x7nHcwvkP4ZcZ3CO9ofIfwTsZ3CO/ifexN4F2N7xB+pTfNm8avNh5E+DXGgwjv YTyI8J7eEm8J7+X95P3Ee3srvHTex3gQ4f2MBxHe33gQ4dcbDyL8BuM7hN9ofIfwm43vED7U +A7hw4zvEH6L8R3ChxvfIfxW4zuE3258h/A7je8QfrfxHcLvMb5D+EPGFwgfaXyB8PeMLxA+ 0fgC4VOMLxA+M+q1qHF8k/n2nP9qfIHwvFCXUA/BjBcQEQy9HZookowXENHYeAERLY0XENHG eAERacYLiGhnvICITsYLiOhuvICIq4wXENHDeAERA0LZoWwx0PgCEYNCv4V+EzeG9oXyxE3G F4i4xfgCEbcbXyDibr+CX0E84Ffyq4gHjUcQ8bDxCCIeMR5BxGPGk4f4t/HkIR43njzEM8aT h3jJePIQLxtPHmJ0dMforuKV6KuirxFvRfeK7iPGGu8d4r2Y1JhU8WFMh5jLxDjiQA8HWN4M aFuKGMXiFFQaWrNDCVjZXKpEScivhVNhhaoH3aY+EC0A7GoNG6IN1t8oamu9RBp0C1l084Fu PVHrWpwxwLj+aHsAXU/NaQjwrgXw7k7wuQtnSxpB91EZ+jvOOLqfHqJ4Ggk0LAs0jKZy9u9Z ElgpIGMykDEZObVZbarD6rC6yK8HrKxjsbKuxcq6FivrWaysZ7GyPrDycUphT7AnUPdJ4GYC cPN5asBeYC9TQzYKGFrXYmhdi6F1LYbWAYaOQ3o8kLQOkHQupbF5bB41ZvPZj9SELQS2NrXY yoGtTRA3BcJKi7DRFmG5Rdhoi7ClLcK2sghb2yLsBRZhywNhx1ElPp6Ppwr8Iz6BqvCJwNxE i7mJFnMrA3NnIP4ayFvRIm81i7wVgLyLEC8G/lYG/i5FvAwoXNGicEWLwlUtCle3KBwACidQ TVFelKckUQGI3NoicpJF5BpA5GTEtYHL1S0u17K4XAO4nIq4LdC5ukXn6hada9i/9Em1f+nT 1v51T6r96562FqnbAKlHUjPnYeA1A16/QL7zojOKGjmjnVco1nnVeZMudN5y3qZ4g+NUDjg+ leoZr1Nk0ZyaGDSnoEFzxHFuHLVw4914qmswneoB0zeQcDe6G6myu8ndRL6b4WaQ4252M8kF 1m9BzlZ3K3Ky3WxSbo6bQ567zd1GZcwaQFFmDQDNbnc3xbh73D1UCivBPmLufvcAeOW5BynW PeQeonizNoCXdjWVlcbBQFPJJKOg5JJTPePPCmlHOki70qVmWD8U+dKTIYqVvsTMkjEyhhhW lFjyZGlZmqJkGRkHmngZT0KWlWXRcjlZDi0nyATQYNWhGKw6lVG3ikxE3eqyBuhryiQqJWvJ ZLRcW9ZG3XqyHuL6sj5aSJEpoG8gG4C+obwQ9I1lY4qXTWQT5DeVTcmRzWQzCsnmsgXabylb om4r2QqttZatQdNGtkHdVJmKO8IKB14XyYuQf7G8FJTtZXu00EF2Ild2lt1AeaW8kpTsLruj z71lX9xXPzkQ7d8kh4H7LXI4uNwq70A7f5N3U3N5j/w7tZD3y4fAcaR8mFrKf8pHqIz8l3yU 4uRj8jH09t/yCdzLk/IptPO0fBotPCOfQQvPyefQ/vPyeZS+ICFRZpWlBLPKUh2ssq9Tihwj x1B9rLVvI3+sHEvl5DvyXaor35PvURP5vnwfIzxejkf8kfwYzwsrMWphJUaMlRj00+V0tDBD fo0crMegxHqM/AXyB+T8KBdSA7MqI3+FXIH8dLka+WvkGrS/Xq4Hrw1yI7hvkpsoWWbIDGoo N8vNoMfKDfpsmY0WcmQO6HfLvaDcJ/eB8rDUVE6ZFxR1zFpO9bGWV6IUVVlVoQSVqKpTA1VD JVNDVVvVo7pY4y+kJqqxakJpqqlqRo1Vc9UcOS1UK2qKtb8NaFJVKkrbqrbIb6/ao80OqgNK L1OXIaej6oiWzd+aMaMZUD2jGSCGZoAYmgFiaAaIoRkghmaAGJoBYmgGZP2JkfUnhhiaASUb zQBpaAbUxGgGoIRmgBxoBoihGVADoxlQQ2gGH4NmgjeBmkI/mEy+N8WbChpoCagFLQH50BJA Od+bj/h773vkQFcAX+gKoFzhraAUL91LBz00BqoPjWEdctZ761G6wctAeqe3E1x2ebsozegQ lAIdogWVC7QMtKQEo0lQHaNJIA1NAjE0CcTQJJDfI9AD6Z6BntQA+kRvahLoE+hD9QN9A32p KXSLgWhtUGAQJQcGBwYjDT2DUqBnvErRwdeCr5EMvh58HekxwTFIvxF8A+k3g/+j0kYLQc6i 4Dbiwe3B3SSNLkL8/yg7/7im7nvhf89JchLwBCm1iJRSipRRRh2lXMaQUUSkjFHKLHPWOQkY QgjJOSEkIYSQnIQQgvP6os7Hen2oY8wy5qxjPIxLmXWOWuaoc44xxxxjllnruD6WMsr1Oi69 n+8n1Ln7PM8fj+f1eefr9/zIyUlyzvuT1/l+oC5CIqiLkChwkeehp3idhuRQIyHpodFw1EgI S40ECEYC/A7/HRLL9/K95DH+u/x3yXr+JH+SxPGv86+TBL6P7yOP89/jv0dkfD//A2if5k/D 8m/wb8AyZ/gzsMyP+B9Be5D/X+QJfogfgmV+zA/DMiP8CMx9kx8lj4LlvAX95/hz0A+uAxzj x4Bv8xfIJv4dfpzE8z/nL8KSv+B/AUtO8O/CM17m4XrET/JTsGXwIXiWaX4a+Hv+Giwzw/8R 9nmWn4Xt/Im/Du33+Pdg+Tl+Dtp/5v8M27zB34C5YE5kMzUnEgbmNE+e5P+N/zeylb/Nfwht sCjo/5j/GLjM/ztJ5u/yd6H/P/lVksR/Aqnjk+BV4SRJvU7Nk0Q1/IOeCHUE2Qqm9Qj0RKtj SDL1LRIGvhUHfEwdD8uAdcHczeok4JPqJ8nT1L1gO+Be5FFwr4tkk/oX6gnyuPpdNbxe8LDL sJ1fqeFVqyfVkyRO/Rv1b6Dnd+pp2Nrv1b+HZwQ/gx7wM5JM/YxEUT8jLPUzIPgZYamfkSjq Z2BbLPs0+tl29DMWzYxb87CQgVHf4tG36Fipl4HUtArRtIrQtCLRtIrRtDagaT2CphWNprXx gTHMChzDrMQxzAocw6zAMcxhOIZZgWOYFTiGeR2OYVbgGGYFjmFW4BhmNY5hVuAY5lAtBwWO Yd6BY5ifxzHMD+EY5i/hGOYSHMP8ZRzDXIpjmGMYlllHNoH/qYGRzCawrlgmFqyL+l8W+N+L JJspZyrIi8xXGfhmovN9gdExOvJPjI2xAe2Mk+QwLsYF7VYwv61gfp3Q/ibzTVie+t8/gf+9 Sr4I5tdN8sD5hoA/Zn4MnjfM/BTmUud7CZ0vH51vGzpfAThfOpGh88kesD0Z2N52tL0vge19 GZ2PjrKW4yjr9TjKej2Osn4YR1mvRyN8AY3w82wne4Dk0mqkpBy9MBYt8Cn2h+wPyWfYEbDA J9D/NqP/Pcm+y74LpkjN73F2kp2E/t+C7T2OI7cfZX/P/hGc8k/sn4B0FHcqVrZIYW+w70PP B+wHQFrfIg5Hdyey/5u9A206xjuJ/YhdhDYd6Z3M/o1dgTYd7/0Yu8p+QuJw1HeCjJGx0KZj v5NkChnkBzgCPAFHgCfK1snWQc96MM40NM50NM4MNM4y2aOyOOin3pkm2wze+bQsGbwzDb1z iyxVlgptmIDPyJ4lz8iyZJ+HdrYsm3xW9gVZDrSplX5OlgtWmiZ7TvYcbJ9aaRr66FfQR3ei j34FfXQnmuh2cNCjhAf7PEH/5iZ4Z7S8V/4G2YT2mSUfBvv8AtjnBbJV/o78EnkOHXTbA+PS FTguXY3j0h/CcemlaKVFaKV5OEb9eXTTbDRRDh2UQwfl0T45tM9oxR3FHXDNBcVH0EON8xE0 ziI0zkg0zmg0zo2KVcUqGAN1yu3olBw6ZSQ65XZ0SpaLBKfk0CY5tMmNaI3b0Rc5NMVINMWN aIfb0Qs59MJo9MLt4IKfh7nUAiPRArev+V8elwdL5nP5sCS1wO3ofxzaHoeGx6HVFaLVFaHV RaLVFaPVbUCrewStLhqtbiPa20buKHeUbOVe5V4FB6L2ls19m/s2yeF6uB7op972LHpbHtfP 9ZMCNLZM7jQYWw73BgfvGnrbVm6AGyLPgb2NQM+b3Ch5Eb1tK3eOOwdrUXvL5H7G/Qz6x7gx WPdtDq5V6HNZ6HNbuV9yl2ELv+Lge839mvs1LD/FTcEy1O2y0O22ottt42a4GdgCNbw8NLxM NLytaHhfRMMrQMN7lvuA+wDmfsR9BNuhbvcst8zdgx5qeFloeNlKVsmSF5VhSsihlVHKGCC1 va1ge4nQpp73RfS8PGWaMh0cjtreNrS9l9D28tHw8tDwXkLD26Z8Tvkc2aQsUBYAqecVoOdt U5YoS2CbtHqCGqsnKLB6ghqrJ6ixeoICqyeEYfWEEqyeoMDqCQrlN5TfgGenNRQUWENBjTUU nscaCg9hDYVSrKEQgzUUYrCGggJrKCiwhoICayiosYbCQw/UUFBjDYVQVRg11lCIwRoKCqyh oMYaCooHaigosIaCGmsoKLCGwkNYQyEGaygosIaCGmsoxDxQQ0GBNRTUWEOhFGsoKLCGguKB GgoKrKGwDmsoqLGGggJrKJQ+UENBgTUU1FhDQYE1FNRYQ0GBNRQUWENBjTUUFFhDYQfWUHge ayg8hDUUvoQ1FEqwhsKXsYZCKdZQiMEaCgqsofA81lAowRoKpQ/UUFBgDYUYrKGgAFN/hGSD oz8OTFA9Q/LQxZ9TmVQmshWMXCA5qgZVA8lSWVSN4L5WlRX67So72YSOnqlyqJoJ/oYHbZfK DaS+vk3lVXlhOwFVAHhQ9c/AQ6pXYGuHVd+CZY6ojpBnVf8DPH6r6jXVa9BPPf6LqtdVr8Oe 9Kv6YflQ1Rlq9tvA7AfgWajZ86p/VY3AFt5UvQlr/UT1E5Kvekv1FvS8rXoH9n9cNQ5boGa/ CavUZKLf56imVFNAavkFaPk5qj+o/kBy0PIz0e+3qt5XvQ89f1H9BZ6duv42dP2XVB+qFmAt avxbVX9V/RWW+Vi1THLQ/p8LywnLAZun9p8dti1sG/liWFFYEXkx7Pmw50keZgI5YWVhZbAM zQSyw8rDyqH9EmQCOWFfC/saLE/zgW2YD+RjPlAQtjdsL9kU9o2wfbBkJWQFWWHVYdXQowvT kecgKzi+lgnQHOAE5AA9mAn0hvdCz/fDv09ywwfCB4CD4YPAofAh4HD4MHA0fBRIq2asx6oZ 67FqxsNYNeNhrJqxHqtmrMeMQoY5wwvrqtbpyefXda17leSuO7XuPCnHmhpyzCLkkDk0gJ3T 3OApzA0+w/8Ac4Mf8gPg2TQfeBwzgacgE/gxtIf5fwUXP8ufhR6aAzzB/4z/GfS8zb8Ddk69 fzN6/1Po/Z8B778CPb8G+/8M2v+T/G/538Ly1Puf4v/Az8DcP4L3Pwne/yfYGvX+zej9j6Px P8G/z79P0vgP+A+Af+H/AqTen4HeX8Z/CN7/OX6BX4T+v/JLZAva/+fQ/p9B+8/g/4P/D+i5 x/+NfJZf4VdgyU/4T0gGSCUDHs+qZSRNLVfLyWfV4ZAbbMGsIAOzgjJ1pPohmBul3gD9NDd4 Rr1JvQmWpFlBhvpxdQL0P6FOhP7N6s2wtSTIEOIwQ9iiTlYnk89hnpCuTlGnwNyn1E/DXFrH JBUrJKWo09UZ0ENrmiSoM9VZ0KaVTZKwskkCVjZJxcomCVjZ5DGskBSn3q7eDqRVTlLVO9Q7 oE1rnSSqn1cXQ5tWPHkMqyXFYd2TR7FaUhxWP0nC6iepWC0pRV2h/irWTNoN/S+rX4YeWg8l GeuhPKbep9bAXFoVJRWroiRhVZRkrIqSqNar9TCX1kZJwtooCVgbJVE9oB6ALIjmRZshL/o5 iYW8CD4P6l+qfwmZz2XIhTZjLvQMZkFlkAX9Adoz6lk4YjQXekZ9XX0d2rTGShLWWHkUa6yk Yo2VZKyxkoQ1VuSEeXQxTgIV5WUHyJ8I0VggHBBuCD/EAYiu+4+MRQOPRyG6IXoh+iHOQAxB jEKchxiHuAQxCTENMQtxA2IeYgFimbA+CYNoVjBYXwDiICFVLAScuqsiIDZAxEIkQCRDpIX2 qyojtA9V2f+PxzzY1mF4LAwFrlMCUQ6xC2IvRHVof6v0a48ChBXCCSGFtrX2yPqOQZyA166D MEL75P2+UJyCGFjrG4Y4u9Y/thYX1+IyxBTENYjrEDfXlr2Ny5OqQGg/6HGqosfiMB7z0LKL EHeh7xgEXfYkxCmIAYjhtedeXXutZyHGIC6uvbbLof1pk69FOPRNQVyD12OBcKytT7d9HeIm xG2IRQj6nLDdajkErFcdCRENEQeRuPaY8vflq7dAZK49hq+tl/nA/ByIfIgiiFKInRC7//5I 37/qfRBaCAOE+f/y/398ZNvoPtkhXKHXVu2DCK693/8fgZ/5B6L60FocgTgO0QPRB3EaYnCt nz6OQJyDuAAx8cD6VzDYNnq8rkLMhOL/eJ45GvKHKg0i8ZyoUpmHgRHms8gx4AbzRWCs+TIw wTwFTDZfA6aZr3tO0LW8qVUZ5pve9EqzyHlOVtpF3nOqKtt8G7l4v51nvus5Red6sypdYpRn oKrQvOoZCLXX6BNjPMNVJQ1yYHlD+P12CbZ3NUQC9zZEA6sb4oD6hkTPMF3LmwuMh3ZQTPKc rRIaUoDWhi1AZ0Om5yzt9xZUHhJTPWNVUkMOMNCQ7y2uPCKmey5WHWwoAh5uKEXuBB5r2A08 0bAPeLJBCzzVYAAONJg9F+la3rKq4Qa7ZKg8LmZ5LledbXB5Llf2iLmeKUpvBbDAc61qrMEH vNgQ9FyjPd49VZdpf2huZZ9Y7LleeVos89ysmmo4BLyGvN5wxHOT9ns1SF3loFjhuV11s+E4 8HZDD3AR23cb+oCrDac9t6vlDYPA8IaR+4xsOOc1Vkc3XPBaKkfEPZ7F6riGCc8ibu3uWk9i wxVgCiXt8Toqz4kaz2r1loarwMyGGSS0ab/XXXlB1Eny6pyGOUlO215/5YWGW9CeEI1SeHV+ wx1gUcMSsBTbOxvuAXdbCHCfhQNqLTzQYInCdowUTtf1Hqi8IlqkyMqrokOKrjZb4oF2pMsS 7+2q9lmSpOjKGdEtxVXOiX7Yh6AlFXjIko6k7SOWLNiTW+IBKbH6uCX3PnssBVJi5R2xS0qp t7dkIXORBUBXSzHQ11IGDLZUAA+17AEeadFIKXStjtn64y26jhuVS+JRaUvlPbFbyqzvaTEC +1osSNo+3eKQMuncjnkNEXs9U/WDLW7giNjbsRCihhP7pZz6cy1+5AHgBWxfwPZESxfwSstR 4NWWbuBMS6+UQ9fqWAaegTYvDkn59XMt/cBbLWeAd1qgh/Z3rGiixFGpqH6phfJey/kgq4kR z0ulRtIyTmnMxfYlINcyCeRbpoFRLbPAmJYbwPiWeamUrhVUGZNaFoIRmniNTtppTG1ZlnZq ksRxaTdlW6QmVbwk7TOmt6wAs1ystI/2dIyH+teYLk5KWk2WOC0ZjLku1X0WuCIkA+0PbkDG anLFWclsLHZtQMbeb5e5EoAVrmTgHlcaUOPKAOpc2UCjKy+YYLS4Cr3pmgLxhmQ3OlwlwWTc mmutx+0qB/opaU/HqKZYnJd8xgOuXci9n7ZpfzBNUyYuSEFjl6taCtJ2MMN41KUPZmsqxGXp kLEbjjzQJdxv97qswH6XE3jGJQGHXAHgqOsg8LzrsHSIrhvM0+wRV6QjGo2ZlY4bx13H/hsv uU5IxzU6s0rq0RjNEVKfcdJ1EnnqfnvaNSD1aSzmDdJp46xr+D5vuM5KpzUOc6w0WN1nKQae tpQBB7E9YqkAnrPsAV6waIATFh3wisUoDdK1vEerr1os3m6N25wgjWj85mTpXPWMxQGcQ95C 3rG4pXN0rrdXc8CcJl3QHLD4KWm7eslyQJrRdJkzpInqe5Yu5FHgHLbnaHs/sXQDOUsvkLf0 A6MsZ6QJupa3X3PUnC1d0XSb86Sr+2MsQ8B4yygwyXIemGoZl65qes2F0sz+dGSW5ZL3jKbf XCLN7c+1TCKngQWWWWlO02+5Ae1iyzywzLIArLAs035ziXdo/x7LCvRoGlnvqOaMuVy6tV/X qAIaGyOkW5oh8y54F4De8/stjRu845pR815Y3tEYC3Q3JlCa98J23NiP1Jw3V0t3NONmPeyb vzFZmqkepNx/oDENjgz0ey/t72rM8E5ie1pzySxIS/uPNmYj86QlWB64v7uxENjbWALsbywH nmncBRxq3Ascbaz2zu4/36j33oDtWKV7mt5GAThudgInzRLsz3ijFXiJkvZ45zXT5oCX7J9s dAKn/07sX9g/2yh5l/ffaAx4VzSz5oNebv98I5C2faxmtvEwtG+YD+PrOoY8AVzA9nLjSeBK 4ylpRss2DgBVjcPAiMazwA2NY/DaYV14vfPmY15es2A+4Y3SxjZeBCYgk5FpjZe9UZpl80lv jGbFfMobr82wlAGzG6eAecjCxmve+CrWPOBN0pY0XgeWI3c13gTubbztU1En8UVoqxsXwU/A DXwbtPrGu55hrdC4CrRa5aEruC+WXgd9CVqnNdxzWytZIz236ZXIl6wNWKPpVckaB4RrjS9N e9CaKMm1h60pkpx+X3wZ2mPWLfDdgc+tL1t7wpopTWhPWnOAp6z50px2wFziy6Pvr69QO2wt kpY0l6ylQDgOvhLtWetOekysu4GhVzpm3Qe8aNV64+kVJ1honHeNSSn0zB8sMS64Lko5xmXX ZeCKa2rt/FxOz3LBXSbWdU0ya3Jd14H0PLPXpHLdpOcc120gnEmC1aYI16LUZ9rguiv1aS9b VrxD2imrwVeuvWY1+3Zpr1vtvr3am1aXr1p72+rznNIuWoOeAe1d6yGfHpY5AsusWo/7hBq5 tcdnrQm39vmcNZHW0z6pJto6CH51xToiRdbEWc/5AjWJ1gu+g5Uz1gkpribFesV3uPK09arv WOWgdcZzu2aLdc7bXZNpveU7UZNjveM7GfKNmnzrku9UTZH1nnSIGoVvoKbURnzDNTttHH0X bPynV/aa3bYo4D5bDFAL+3a2xmCL943VmG1Jvos1dluq73KNy5bum6rx2bJ812qCtlzf9ZpD 1GlrjtgKPBdrjlN3qumhllLTZysGd0VvrDltKwMO2irA4uhn42bNiG0P8JxN47tdc8Gm8y3W TNiMvrtVi7jkFZvFM1Zz1ebwrdbMUHOrmbO54Vlu2fzAO9RRa5ZsB4D3bF2eizpiOwrkbN2e 2zre1guMsvV7FnUxtjPAeNuQFK5Lso0CU23nfU5dum3cM6bLsl1qk+tybZO+s/QItIXrCmzT oc92W6Su2DYL2ymz3ZDkugrbfFu0bo9toS0uZJg6jW25LVGns620pdDvRdsWndHOgqWDq7dl InN0FrsqZOBt+cgiZClyJz7LbuQ+ncMe4RnWue0bPGd1fnusZ4wadZtWd8CesNY2IM30+9Vm 13XhkQQfbnMhfXSv2oK6o/bktiC2DyGP6LrtaZ7rul57BvgwWHHbcV2/PTvkwG09yD7k6eoU SzocqzP2POAQJbXWtkHkiG7UXhgy1bZzuvP2Es+qbtxeDoR+6Llk3xWy1rYLyAnkFfqtb7uK nAlRN2nfCy4KRto2p5u2V4N5gpe23dLN2vVSnO6GXQDO263gnMftTnBL+r7cQS7pFuxS273q JXsAvt30zDyjW7YfhKvnkh3On7oV+zE/0fTaT9Argv2kn6tl7ae847Uq+4Cfr42wD/ujajfY z/pjamPtY/74tXM7nr1rE+wX/Um1yfbLcDZesU/5U2vT6JmwNsN+zZ9em22/7s+qzWtk/bm1 hfab/oKQA9SW2G9Lc7Xl9CpTu4uet2v30mt0bbV90V9cq7ff9ZfB1RmutrWCfRWuenDW8lfs 72+S+ytqrZYu/579BU3h0q1aZ1MkbF/C67K/KRq2E2iKg+0fbEoEHm5Kgav5maYtsOVjTZnw jCeacoAnm/LheU81wTmwdqCpFHqGm3YCzzbB2a92jF4pai827fNrai83aeGYgEv4Vmunmgy+ s/TV+XW115rMoTOt31h7vckO27nZ5PLG0yuy31J726z3O2oXzQf97tq7TT6/v3a1Keg/oJc3 HfJ30ePmP4rb6dZebjri79WHNx3399NzuP+MPhJtB5zHP4Qc/dRqzGn+88hx5CXkJO7DdIj6 6KYe6Yo+rqlPuqpPpDZCzcQ/q09pOh1qw/WO9tygvuGf36+zrPjn9VuaBkNe4V9ALuOrWNFn No20s7TdrsKeeX1O0znpjj6/6QIYBXhFe4S+qGkiZBH+WeQ4chLeiyvSPX1p01XgzqaZ0BXf v0LZvkG/u2kudJVvj9Xva7rlJXpt0x0g9EOPoWnJy9Gj156ATEam0etUewYlvGqk3tx0D67d cAVvz9bbHQSu1HAdb8/TuxycN0bvc/DAoCMKrmIljhhvEr1GtxciS/A4jOsPOeK9nP6II8kb pT/uSPXG63sc6dKgvs+R1V5uinWtBvWmhFZ5oMeU3BoOTGuNlPaZMlqjpUxTdmucZ8qU15oY FGCZFJhb2LolaDWVtGbC3PLWHOjZ1ZofdJr2thZBNpTUWirtNlW37gxKmpjW3VKpSd+6Lxgw Ca3a4EGTtdUQPKzJbTVLZpOz1d5+zSS1uoLHTIFWX/BEKDvQlLUGpaDpYOuh4EnTYfD/U6Zj rUeCA6YTrcchjzO29nzq4aaTrX3BYdOp1tPQHmgdDISbhltHgmdNZ1vPBcdMY60XghdNF1sn gpdNl1uvBKdMU61Xg9dCGaiRtM5AzhXKdDCnMF1rnQteD2V5puvQk2+62XoLci56rb9p3NN6 BzjbuhS8bbrdei+4aFp0k+BY/RxdUhPl5qQi0103H7wbyrPq7e6o+/ks5pimVZpXQibYTTM+ d8z9Z9e444GYKwlydxJkTKEcZwhyzENCeGtfW0r9kjtVKhIi3enBVSHanQV5FhyBTrkQ584N uUpnuJDoLpDMQoq7WOoTtrjLOiOFTHdFZ3QoHxRy3Hs644R8t6YT8/HOFKHIrYOcGjLrzhAz hVK30TNFM+jOHGQ+pbcC20X4LKUhCjvdFilH2A05V76wz+2Qimj+27lT0Lrda+3dyH3Ulzq1 a0cSstdOA6VvA92r9g2Cwe3vNNN2px3pEszuA5JWsLu7IHuFHLbTJ7jcR0MZa2cQeQh5xOh2 d8MR87l7gUFKmmO2LVF2HhcOuftDeWVnj3DEfUbyCcfdQ0Doh54e92gox+zsQ55GDlKL6xxB nkNeEPrc5yFzhPyxc0I47R6HPBGyyM4rwqD7ktQjjLgngefc03DML7hng8P4vlxFzsCn4kab S5hwz0tB4Yp7QTouXHUvw5Iz7hUpRX/akdu+C3MHvB7huStBmtEPOgra9+pHHMXt1ZoDjjLf qv6co4Lmd4497Xr9BUpoa9oF/YRD124FGu/zisPS7tRfdTjaJf0MrHU1lNPp5xzu9oD+lsPf flB/x3Gg/bB+ydHVfkx/jp4/Kb3T+nuOo36eZmftJ5An9+9xdEtzdcTR236qjnP0t5/SjDrO eOfreMdQ+0BdlGO0fRh5Fs+TY2u5FbD9Yl2M43z75VCeVRfvGG+fqktyXGq/VpfqmGy/Xpfu mG6/WZflmAWmO26038Zz5iLybl2uY759FbgQkNcVOJYD4XXFjpVAeOiaUlfWzAYi11jRrApE 1+1pjgjE1WmaN7Sl1OngepRUZ2yOlTLrLM0JgcQ6R3NyIKXO3ZwW2KJZaM7wRtX5m7O9fN2B 5jzJR8+T/m7KQGYVC1dDaDcX+rtD5qbTNZcEcuq6mssD+Rp/865AUd3R5r2B0rru5ur2Xfor zfp2Z11vs9AeqOtvtgZ21p1pdgZ21w01S4F9daPNAWlf3XlHRUD7D1sbbz4YMNRdaj4cMNdN Nh8L2Oumm08EXHWzzScDvrobzacCwbr55oHAobqF5uHAkbrl5rOB43UrzWOBHgPbfBGoar4c 0K4xonlKGjRsaL4W6DPENl9vnzIkNN8MnDYkN98ODBrSmhcDI4aM5ruBc4bs5tXABUOeUx6Y oO9v4IqhULMSuGoocYYHZupGnXDON5Q7owNzoffOsMsZF7hl2OtM9DkN1c6UwB2D3rkFKDgz A0sGqzMncM/gdOb70zWXnOAYBskJeZYh4NzZQQwHnbs7OMNh5z7gMcdyB2844dS23TOcdBo8 U4ZTTnNHlGHAae+IMQw7XVKO4azT1xFvGHMGO5IMF52HOlINl82BthTDlPNI+2HDNefxjnTD dWcPLHnT2deRtfYst52nO3INi85B31nDXedIR4HmQN24dMGw6jzXUaw577zQUVYvd050VNSH O6907KmPdF7t0NRHG2I7NJpp50yHrj7OOddhrGKdt7xJ9YnOOx2W+hTnUoejfovzXoe7PrOF dPjrc1o4P1+f38J1HAhl/fVFLXxHV31pS1THUWovHd3UUjp66a8oHf2hbxz+glFBjcI7/9++ HdbQbwWhXwY6ztTvbInpGKLX945RmoN3nKefxo7x0K9D9Pzgna7f7aiA7eNvNfX7WuK9/fqJ liRv/9qvN/R3lfl6rTm541JdV0tqx2Qo6683tKR3TNeb4bvMEpZsZBaYjwhhPmaWCcvcY/5G 5MwnLEM4VsFyJIxdx/JkHRvJPkTU7CNsNFnPxrKPkofYRHYzeZhNYZ8ij7Cvsa+RjbJi2ZdI jKJc8RUSq3ApWkmc4l3FuyQ+QhuhJY9H6CK+RRIijkb0krKI1yPeJV+P+N16BfGtj1ifQX60 PnN9LrkKe7OTyHH0ZARZT8LIQ6SCrCO7SDV5kWjJN8le8s/kEPGTLvIbEiC/Je+RCfJnJpz8 juEZNfmEWc88wjBMLJPCqOhdjMxGZg9Ty8QxdUyASWWCzBGmmDnGvMZ8lfkx8yvm67I3ZG8w drlVbmOa5JLcxzTLg/JvMi75K/JXGEn+qvxfGK/82/LvMn75GfkA0ykflr/JHJT/VP5Tpkv+ jvznzCs4Pu6IfFL+G+ZV+az8OvMv8pvyvzDd8g/lHzI98o/l/858h97TxpxUbFRsZL6n+COn Yvq59dwWZop7hnuGWeKe5bKZj7ltXCHzNzoCgPmEe4ErY+VcOfc1luNe5nRsBFfPCWwcZ+Zc bALn4YLs09y3uGPs57njXB/7Re773ABbQu+1Z3dyI9xv2Ze4aW6abeCucXOshbvJ3WRbuHlu nnVxH3FLbCu9a4r1cv/JrbIBetcUG1SyyjC2U7lOGcO+onxMmcB+W5mo3MJ+V/mMMp8dUJYq m9jzSrfyNfa2skfZI+OVvcrvydTKYeWbsofp33uSbVSOKd+WxSnfUV6SxdN7d2TJyuvKP8sy le8rP5JlK5dUrGyHyqi6K6sI+0JYrey99dvWb5PTMVFGEgTyJJ6ODi5gISIgYiHySLIwW+gu 2lk4LtwoPCPMCwvC8pfmhBWRLZzfmS9miNli3o5ssVAsEcvFXeJesfqF/hfOi6od18WIHRd3 3BQ3iLFigpgspr1wfscYfLbk8ElfwE/6x4RhPmE+ISx8riNxLOljeHcoYX/A/oAw7BvsGzBv gP0RkbFvsW8RBd4dyrG/Yn9FVDgWKIz9DTtFwvG+UB7vCFWz77HvkQi8F3Q9+yH74ad/10fG yJj7f81MIeNItIyX8SRGFi2LJptkMbIYEot3bz4qS5GlkMdwjFC8LFeWSxJwdNATsnzZNpKI oymS8M6NJ2H/eSYKjxwlEfKJS8gXigRwMGG3sE/QCgbBLNgFMCfBJwSFQ8IRiONCj9AH/zMI p4VBYUQ4J1wQJoQrwlVhRpgTbgl3hCXhnkiEJZET7oi8MCHyYpQYI8aLSWKqmC5mibligVj8 D9O4WCZWiHtEzf1JJxpFi+h4YHKLfvGA2AW9Rx+YLomTQKPYLfaK/fD46XRGHBJHgXQ6L07D WsXwHLPiDXFeXIC1lmGLK+JRMysazSpzBLx+JmwQ3kN6BwN8iuCsQY9JDEwyEgeTnCSTzxAF SYNJST4HE72/OwfOL7kwhZM8mNaRQrIDR9h9Gc49obF1L5M9OLZuH2xPC9PDRA/TBtJIrOQR 0kycZCPxwLSJtMEUC2elV8ij5FWYHiP/E6Z48jrpI4+TH8D0BDkDUyJ5E6bN5CcwJZG3YHqS vE0uwP5NwJSCf6XvKTJNfk9SyR9hSiN/hulp8gFMW8gi+Svs+13yH+QZsgrTswzLKEkmEw5n wBy8p3srnAEjSS7e053HxDNPkOeYzcxmsh1H9hXCObGc7MC/YFXEfIPRkOeZaqaafBnv7y7F kX0vMEbGSMoYkRHJi4yNsZNyppXxkZ1wBg2Q3XAO7SQvM99kDpKvM11MF/kGju/bB+fTEVLJ jDKjZD9znvkZ0TLjzM+JjvkF8wuiZ95lLpE6/PzWw1lAIEYVvHFExHvozKomlYM04H1zjSpJ JRGryq/yExuOc7HjXXJNqj7V90iz6vuq75MWeG9vkmX87GfRSiumeIgkiFSIdIistchdiwKI YvI1U5Ip1ZRuyjLlmgpMxaYyU4Vpj0kD1JmMJouwaHKY3Ca/6YCpy3TU1G3qNfWbzpiGTKOm 86Zx0yXTpGnaNGu6YZo3LZiWTSsCK6iECJg2CLFCgpAspAkZQraQJxQKJUK5sEvYK1QLeuGu IAhWwSlIQkA4KBwWjv0Xe18DFtV1rX1m5syIPxmVGqIECSXEGDTGEEONoWqNQYJwZqBEvcYq QTlz5odh/mfwWmOstdRaq9ZQS4zhs5ZSLjWGGoJWjbH+1XKpsYQYa/38iDXUWOI1XmP9jLlr vecMjkCqfe79nud7njb7ed+z2GefdfbPWmuvfVTi3uze6q5333Bvdze5d7v3UznibnW3uU+6 z7jPuS+4L5SL5QPK+d8j6I0uo5+2wp+Yt5LF6sk+/6fsO5/KYFj5EFj5UFj5l2Dlw2Dld8PK E2Dlw2HlibDye2HlSbDyZFj5fbDyFFh5Kqz8flh5Gqz8AVj5KFj5g7Dyh4QWKumw9TGw9bGw 9XGw9Udg6+Nh64/C1h+DrT9Otq4XMmHfX4F9P6EbqUsmu2fLzoJlfxWWPRn/ZmEKrHkqrPlr sOZpsOanyJq/ST7wgu4F8gH+lwszYM05sOZc3Q91PyR/YJvOw79ZyIc1S7Bmq66F7LhQ16pr Fb4e93Lcy0JRXE1cjfBs3Gtxr/G/yR2ybMgqWqdBNPcDBZ2/TRBcdYRthB2EXVrdPsIhQgvh ONeJQ131/gZ3zt8G2kjBXNd2f6Oryd/sLroVXOfa7d/rnksoDloZrv3+A275b4PbuI74j7pa /cfcrpvgn11t/na3jxAJznKd9J9yL/3bQJsVwXmuM/4O9yp/h+ucvxO44O9yryVUBc5C3hQs cW8JKq5L/suuq/5r7rqbwM/bgm7XjYDg3nEb7AoG3PuCi8vEgAkYEBhUNiQQ7z6kgmUem7vl JvjnsoTAcPfxwHC+AkmBZPeJ24PblaUG0spGB9Ldp29F2bjA+KjeWJRNCGS6z95E2aRA1p3A 11YxpGxqYFpZdiCnT+QFJIbvZEUCo6wwUHRHmBOYWzY/UNwLiwIyw3cmJJY5Aq47ge9cRVKZ J+ADQoEIsCSwlOG7UJHKV+/ZSEpZe+BE2fLAirLKwKqe8F2qGF22JrD2dvBdrRgHHRsCVUB1 YFNZTWDLLagN1PVCQ2DbLWgM7LhjNAd2le0N7OuFA4FDZUcDLb1wLHD8FvC47wDu88FlZacC p8s6Amf7BN1zXwyudF8Jrka7zsD5O0JX4GLZ5cCVXmB91wOny/XB9WXXAtfvBOVxwY1uIajv hikYFwXumwnDgpshJwa3lqcE692Dgmb0twfKRwW3ow/xwWG3Q/nYYFN5RnB37PPu4cHEW5Ac TOkFfnZicL87LTiqfHLwCK7Tg6199eeL4E4PjnWPD2b0QmZwojsrOLkXpgWnx6I8N9gWje23 xGItVkZjXLk1eDIag8pnBc/ExpFuO4ldV21NuudoXvBc99yWBC/E9gmx5AbFFPJ9v6jGAP8A zYfJr/xDAmt532B79ycQkiomRO3Zn0pXeg/fL1eCl8rdwavlgeCN8sUhkfeX8mWhAVzPYytf GRpSvjqUwPG1fH0oieNk+cZQavnm0GjeA8q3hsZxbMeYyd7L60MTovG5fHtoUnlTaCqPu3x3 KJvnonx/KI9jJ+sEjoQKy1tDc8rbQvPLT4YWlZ8JOcrPhTzlF0Ih7JG8B/GewHN4ifZJbT8r v0r7T3Seb4QSPGJoCevge54BoeWeIaFK7D3RvTZmjbp1MrQ9JboXcJ94b/QkhNZw3zxJoQ3d 68ztae147bEv057HY/Okhqq5zjOa9vDtKni/5vm9BfvVfRl7Fu/H9J7oXsxXgOwHY+uxx/KV 4Rnnv8zgPTa6r0bhmRAwMaJ7JPZMbW+M3Stv2SO1fTIKzyTaB2mNsffRfuiZGhjPgN3yPjdB RXfMIniyQzW45oVqPYWhBvgYxQ/PnFCjZ36o2bMotNfjCB1APfkw7x/wW/Ij9iePJ3TUEwod 41jkWRJqh19ofhCNi2xbrIfjnGc5xaeoj/B6Udzi56MxsJdv9fCraHzp9i3WQXHTUxk6hTVf E+qIPo/25G+eDaFOT3Woi/vtqQld9tSGrnEMR0ziMTSEBU9j2ITnbheDtH55mrU4Ho1L12Pa aH3GWHvE4+7xUByO4gtj3RfEU89e7XogOIrHFEWvOBkbKzk+RmNkTDzE2rMebsOxiebAczS4 3z+6YpJ/XMVUBuc2vN6c0/gnVGSjjmKWNye8wj+pIi+av/inVhR6roUzEcco7/BnV8xBTkEx zZsWLvZcDo+P5gT+vIr5iGm8/3PewLGusGIR79H+ORUO//wKjzcz7PMvqgj5HRVL/J6K5f5Q RaV/ScUa//KKDcjJtHjJzyI3i+ZNnPNoOQp0aTrQx8qKao6X6Fc0t4vmYY6bMRiI5jBa7sG6 OB/zr6mo4XzHv6Gitvt5bs/j4Z85F+Sci8bmr65oQB3njVFoeeIt6JkLarnfLdDmtWde1w3O xaLomddFc7Q+cjN/jYrb5mace8XmX5xzRfOu2ByL+8rPcpvonPT0LfI/z7HwoF5+1R6Oj+ZY nlPh4Z6OcDLHou541RlOY7v2dIXTYU/Rem7DPsf2R1evEM7ymsLTIA8K53jjwxIj1t+8w8NF HCO8yeG5bJ/e9LDcK48heMeHXQDZIwN+SHHLmxWO4DotvDTqg+wTXim8ylsUXtvtf+RX3rnh KvY3b3F4k1cOb/G6wnW890SBeERnLPgfjdnrC2/zRsI7oJvih3dpeBfGqbX3rgjv864KH/Ku Dbd4q8LHORZ5N4VPeLeET3vrwme928Lnef9jIE5STuDdEb7o3RW+wvHYuy98ne2U90LvoYje 2xKJ8x6PmDFfJyLDvKcjiXxO8J6PjOJ58l6MjOX23iuRDO/1yESfPjKZc0CO/9HY7IuLTPeZ I7kM1od9hs9DwyJWnndfYmSWLyUyj+3MNypSghhG6+gbG1FwLyPiho6JkQDHct/kyGLf9Mgy X25kpc8aWe2bFVnvmxfZ6CuJbPYpka08vz53pB5xjMbvC0S247o40sT24FsW2e1bGdnvWx05 4lsfaY3aD+fgnH/4NkbafJsjJ31bI2dQr8VcX33knG975ALrZz/xNUUu+XZHrvr2R25022r0 HBDdo0j2HakQuY2vtWIA1wl6QWduMbfj9yj+889R/rH+HOWCcOnmnwbYZMFlW2Vba6uybbJt sdXZttl22HbZ9tkOEbfYjttkrawFTthO21xaOWs7b7tou2K7ruiVOMWsDJs9QUlUUpRRylgl Q5moTFam21bYlqpFiWMouYqV6lBmnVFmKfNmj1ZKbBFFUdxKYHaDslhZpqxUVivrlY3KZmWr oth8aqEW9cp2pUnZbYuohVrsV44orUob+sc94pZ8j99Ib+Cv/XddJAt/5n/ka2g+eYiFylB8 DY3H19Av4Wvo3fgamiAogkO4R3BRScQ30XvxTXQkvoneh2+iKfgm+mV8E70f30TT8E30AXwT fRDfREfjm+hD+Caajm+iY/BNdCx5XoswTmil8ii+iWbgm+hj+Cb6OL6JZgofCn8WviJ8RGUS vow+iS+jX8WX0Sn4MjoVX0a/hi+jT+mSdcnCdHwZfRpfRrPxZXQGvozm4MvoM/gymosvozPx ZTRP903dC4Kke1H3olCAL6OF+DL6dXwZfRbfRGeRv78pzNbt1O0U5uLL6HP4MvoNfBldIK4S vycU4zfRlYjN4k5hEXn3IUEWO8U/Cwp58RWaS50QEZbetFV5gpAhT5AnyVPlbDmPSqE8R54v L5IdskcOyUtQDshH5WNyu3yKSofcKXfJl+VrNsFmsg3iIi+XK+U18ga5GqUGXCs3EDfKzfJe Lmw3+jFkNw9rdhOP97PF6GmNHiTrYVsRaf4zyHrYVkywlX5kKU+TDfGX8/5kHXPJhtg+BsI+ BuFr+V00LidZElvDELKFdWRPbAfxZAW1ZE9sAcOE16ncDQtIgAXcQ+t/gOyWv4qPoDV/nyyM V/1erHoSvoSPpJU/LyRjjVN0Q2iNv4zVTcW63o8VTdMt0BULD2BFH6QV9QijdSFa0XR86x6j W02rOBar+DBWcRy+bD+ie1PXLIwXdHGZcVk316O0UhxaWtmzyCfk06VrSjdEi3y2tForNT2L fL60trRBLfLF0sbSRvkK1fQo8nWbvrSZyl4qB7jY4mxmuh4tPRYttmGl7b2LLREa2ktPaaVD LbaU0s7STlsccVfvYhtVern0WrTIArdVi2zSyqCexTXclSzHy8OjxZUmJ2slrWdxpcvp0Xe5 xstcBDm9Z3FlOlPlTCr8viwurizZR9dpck60KIt6ayf906AhrXtmJbW4cuQiucglEc/tXVxF NL7iaKGnbv7n0oqpZ7GNtWVQnyLRYpuo1U++ORPRYpsuL5VXdBdqRe9YdWux5RKs8lqUKrnK Nkurn2croeum6IionLIp8pbexeaW66hsk3dwsQXkXWqxLbYts62U99Gqr5b39R4J9Xk9zdGh 7tIiH+8uWWqxbWT7tm2G7dbattrqYWPbYTNNsKjdpGc/xrvKdoQk7tF+6Fc1kaXYmrBK6a65 rmKsVjHPvtLOE23LtbWS76yxtZHnVNtO2s7YztkuyD7bJZqrHNtVsuW9thtk7+2KqAzITSBb 7lKGKAlKEl1TaUY7ZB/9PFoZJxcrE5RJylTqMdt/l5KNWdur5Cl5pR3corRBKVTmkC72WowI LVVfYdvsKG1U5stblEWllYqD6jup3Qbyuk7FQ9IaJaQsKa1WliuVyhplg1Kt1MCXG9Wi1CoN 7K9Ko63J1qQ0K3vJW4+qHqscUI7ibfQm5Rj1pp19UjlFmjuUTqVLuaxcswull+0m1f/YA2WT fZA9nmzNB3sz0d3htM5V9mR7mrzNnm4fT2s8Ud5nz5SzlFR7ln2aPYdmfRWtgMkukZWyzVXZ i6jMldfas1QLpIK1QrstsBmqsxcTZHmLnSze7qP64/aIfal9hX2Vfa0csVfZN8lrlQT7Ftln r7NvozY77Lvs++yH7C32Kti4yX4cek7YT9tPkxU32c/az9sv2q/Yr8ubuJQ2OPT2bY442OoO +3mHWd7lGMZ2SrzPkaiccqQ4RjnGOjJkyTFRPuSYTNa7jC3RMd2R67CSBR+in0y2lS5Zjne5 HGQjcrLLR9E2yxWRt7iWlnaRBcsUBUzOZooUaa4VpXmuVaUhGu0ue5VrrauK/ZpshmbLtcm1 xVXn2uba4dpFFkqRg6JBMtuAbHLtc+2jFodcW0q7nFNtR0gXxztYMFoiysCCU+XxrpbSy0ol RcPjdEemdsPJb4pcJ0iK51mQk5WQ67TrrH2L67zrIkdBWY1/43muMGe7XFeUdtf1Mj3FuWlq rCuLKzPz2/hNZcNkqSyRoxlxUVliWUrZqLKxSkJZRmln2UQ1ciF2uZT2ssnKEnmXczT3xDGL tLPt7HLMc5TIJofChXqbSv1Oc7jZPhwBx2K75FhGd1fCJiR5lWM1lfW04pscGx2bad22Ourl LY7t9nRHEz/raJLrHLvJbopK2x377ZkON5XdjiOKx9FKb0yjcZ9RRNsZucjR5jjpOOM4R97T 4bjguGRbVnpZzirdYE9T5igJ1LNtuHPVccMp2tOcA5xDnAnOpNJTtAtUydscW+XxztHOcc4J i47Y2min8dmuOifJmaQ5yzmV2mfLkjPPWeic45zvXOR0kNWmkzW4KNb7nB5nyLmkNORcLqc5 K8mPKe4619h30AiHy1VKEtnIBme1nOOscdY6a8l7JNLZ4GyUz5LtrKLZq3v2nHOvvMJ5wHmU +Jiz3XnKeUCuc3Y4O+0uZ5fzMrVOcF5zlFDqa7JnugTylUzXIFe8PdN+EdnUw/88Z/7DnTMV wYO/4ZDA/6+GhcmCbmGxMGxhIpUUKqMWjponzZMWjl049rn259oXZizM4Ou8ufPmPl/5fCXq JlKZvHDyvBXzViycTiWXCj+XSaVqXtVC60IrvUdv3mB+id4xBOcaAecaPU40BmS+Ik40Rpxl TMh8++EsE4ezTH+cXwbi/DIIma8Zme9gZL5DcHIZijPLlwTdkEVD3BgT/g5iyXpBV1JP1410 3S4OnTmkZOudIG8HXRMISV+AVBV5h1TMHH2HGEeY0Acmqcg7Tdepd4a883TN1pCnoVBFXo56 zdcT4kieQ5jfG/nD6Lro9shPIYwi2aHBQwj1wLg+sKQHlv8dqCSs6QMb+tDLqO6BmjtDAc99 LaHhC9CoomCqipnNd4i9hAN94KiKAl63Y3eGAl7bdg2nNHSoKChUr9ZcWvcskjsJXb1RwDZw +fYomK/puKYiTyCYemBQH4jvgeF/B5IJaX0gnTC+D2T2QNadId9K12mqf/QJupc/izBPayfd IYoIc/vANE2nQtfiO0O+m65yDFwxiLZZrF2XEVaS7Lv5rljkr9bkyO2Rv56wsYeOpT2wog/w s5vpuoquW7Vrfd/9+UKsJVT1gU2ELX2g7lbkby+5Gb9j4200XkbjWNPN+JK/+9b40W0nsesa XZfoHO2Pmdsjt/apO6bExoCoD0f9i/cMzeYLqA+32HSxej+/ldBGOKnGCN5f8s+p9Tym/AuE SyWIryWr1TiZf6NkqySWYA+QBpSo8X2Rau8Sz4kWnyXa06QkdbxSqjoP0mg1XrJOhsR6yRYk iosSzZ1EfZBYb6E2v9H55P7zPhndw/Ji5pn1OFQdfE+i/UIKaf3quU491qh7P4muE4+V+7JE 7Zu0POb5Rdr68c88rkJtbJVaXUIMUvtAz315Uh+YWnJzf43ZY7sxJwY999jofvnf2ScrS27d CzeU3NwDY/a77phFkBq0K+1bUrNWT/FDoj1Joj1Iov1HOqbVkw/z/gG/3a76k0T7jHRKjUVS h+YXUT/Q4iJs66gW51wxPnJJjVv8fHcM7OlbPfyqO75EfeuS1v8ubc0vxzwfUf1Nor3JIqj9 ttCeZOE9KEeLSTQGC+1BluHac7eLPz3jeF9ton3uIx53wxeDL3rX7eLpqh7oGSdjY+Wmkpsx MjYmTtOerdLuZakxuoDsp2CDCs5teL2R11RrdWQrlm0kcxzT8pcCyo0sxVocozUt4JyoS41n Fp57ni8tJyho1GIZ7/+CFufY/miPLiB9BaTPQv0t4PyH8xqyswLWyXlMpxY/tXiJZyeV3Myb Tt2Mo9Cl6UAfu9R4iX71jMM9YnB3DhONwzxO1sX3yaYKrsU8f1kdD35u0PyExlYoaHW1MWjs Az1zwaN9QJvXnnldNzpj0DOvi+Zo/53cLLnk1vwrveRm3hWTY3Ff8WzazTnp5Vvkf5bM3n5l ySrpzrEsVG/JUWNRtJ1FUu3aUqTZUzSO7VX9yqL5l4XiikXzOwv5mCWiItbfLOxXXL9Cs8+1 Jb3zGIKlSsMmFfA91r9Fu9bd9EH2CQvtdZZdMf5H7Sz7VH+z0B5taSEcV/eeKHi8fMbieeIx W04QTmu6aRyWs9o4tfYWOtNZLhKuEK6XIBZZ9QQ6w1nNhGHq/sdAnKScwJpISFHjsXWUZqe0 F1rHEjIIE9X5sk4mTFfPCVarOk/WWWp7K+0d1hKCouaAHP+jsdlKe4A1oCFD3WfYtq2L1Xm3 Ug5qXanamXW1Oo+8jtb12r2Nmo7Naiy3Uo5opfzQSrHHSvmYlfIwK+VVVsqnrK3q/FrbtDjG 4z+pXc+o9mClXMhKOZCV9gjr1Rj7oXdyPmClXKiAcqGCAVq9FnMLKB8oSNDWj/ykgOaogHKA gtExtho9B0T3KJILxqltCiaodfibGXHmgf/8mxn/eF/MxHTxAP/pqv6o8Jog9EshjCKMJWQQ JhImx1ynE3IJVsIswjxCCUEhuAkBwmLCMsJKwmrCesJGwmbCVkK9hu2EJsJuwn7CEUIroY1w UuvDGe2d577geoFwSQO3v0q4IQhxImEAYYjat7gE7ZpESCWMJoxT9XRfJ6j3ua9xkwhT1THH ZRPyCIWEOYT5hEXq++IcBA8hpOlfQlhOqCSsIWwgVBNqCLWEBkIjoZmwl3CAcJRwTLu2x7Q/ RejQrs3acx0x9zsJXYTLhGsCOSvBdPPK89OfPLl/PGE4IbmPn3te0wjphPGETHUu/y6MvRX9 szRMI+QQJEIRYS6hWKvnq0xwEXyESMzzSzWsIKxS0esda4HX8mvya/Mb8hvzm/P3Agfyj5pM +cfy2/NP5Xfkd+Z35V/OvyYJkkkaJMVLw6VkKY1KujReypSypGlSjiRJRdJcqZj/2BrwSRH8 vJTKCmkVYa1UJW2Stkh1+R3SNmmHtEvaJx0CWqTj0gnptHRWOi9dlK5I1y16S5zFbBlmSbSk WEZZxloyLBMtky3TLbkWq2WWZZ6lxKJY3JaAZbFlmWWlZbVlvWWjZbNlq6Ue97dbmiy7Lfst RyytljbLScsZyznLBcsly1XLDatIGGAdYk2wJllTWcbPo63jrBOsk6xTqWRTyaPCV/6Z5UIq /PMcKvOti6wOKh4qIesS63JrpXWNdYO12lpjrbU2WButzda91gPWo9Zj1nbrKWsH7Qwj+vxN DIL2mxji8JsYBuA3MQzCb2Iw4zcxDMFvYojHb2IYht/EkIDfxHAPfgfDCLNsDgv3mivMq4SH zT83bxOmmBvNbwpPm3eZ3xJmmg+YDwoF5qPm3wpfN783WCc8O9gwWBSWDTYPflRYjt/KUPv/ cc90unidB393ZRf//7bvP6aBvPx+8ur7yZvvJy++n7z4/ssxMoM8mpwRdWnkzWmD1Pq0eA3D NZDXplHDNPLaNPLatEy1bVqW1p7ryMvScjRdklZfpGGu9l6+V6z+nCYLY/KrqcR6FHMz+1SM R6ml26/yT0mDyC8E9q78RvhXrHdlShKt1WD8Bg4Bv3tDj9+9YTBHzBFBNH/PvFowmn9g/qHQ D7+HY5D5p+Y6WofXzK8LI83N5p1Cinmf+ddCqvmI+TfCqMH6wXph9GDjYKPw0OCMwRlC+v9j 7bobz4lPES83+okHQrZC7g/5Ua0+h3iCMYD6EtT/CPJq4gzj65BzIKvPPgrZimcfIR7H9Z9d Fd3Qw88OgP4U8THiecbn+O9BGRejfhpxtjFIvAFtXuX3ftbI8md/QB+qUP8K5MfAE/DexzRm PTOMXrx9GmR+++fiGJKno81k8NPa6MagTTl6+BT6/wT678NTLPc3XEGvknjstBHTvBn5qZEY 9VxjGfFXNW2DIT8O/Vw/CDU5ximQn4KstszEe8mbbsRBng55gDgJ9TwuAfVPa/UsZ0HOBg9E y2zMz3+IT5L8sNGJ/k/CUywPNFxCm3E8M1ivAqMLz67GXLE8yPBn9GoE8TCM6G6eNxp7CWRu qeP6z/6CVfgLZlWH+hngfmIdjxo8FDwD/BhaDhQngguJv8Jj1xcYZf7TbGMx8bd5LPoQ5Cng Ezzz+qXcRqcHv4T2GcwGGW1eMi4kroW2oVyje49l3Se4uw7tn0b7H0AeBj2fgM+g/TXxt1Sv Fw8SF4ptrJ9l3ceokcX3iLO4jXCFWZcL/it4D7PBgJbPQM+z3F73ATTUQf4F7s5A+8/RPh3y OfB+8Bto/5FItqfPM/6aZPiI3mR8i+QbXK8rMR4l7hDJlvSJ3Eb4yPgi8X8y685pNcSGDOhJ BCfh2VLwOvA94ue4+zzJv2PWn4K8G3wM/JI4j1fH9BHx9zVuAteDK8FdzP2G0xuvY7bfRMs3 Tfx7XDZAngL2anI9uBLMzz6Dlldwt4NrDANQsx01Neq6s6yboHETuB5cCe4C81PPoP02PCuA M4w/Js7Guv8VNYc15rHUQj4BvqDJTeB6cCW4Cy2n02kizVgJG1OIn0f7p8CPgvuDHwCvA/8n +NcaN4HrwZVg1vx/MHs/4DaGt8FHNZnH+Amena0xPxsPOYnHq/vI2ELySPAkTX4F7AEvAB8E XyCd92D1r6JlPLPuvMYvwqL2s6Wh5gY0xLMGkg9CfhG+0wI+CFZrdlGbx9GrLxsPwAJZQ39m kj3gBah5h+SfwrrOwG5fY5mstwV+xPVldCbR6Sxsw9QfdVw8osNs+fok1CShJgk9TMIYk9Af iXtC1t5AI12MkX4LmreB14F3ahrY4/zwpntMd1PNRNQnQnMiNCdCcyI0J/LskVey/nq0PAW+ qMnUXrcZ+o+BuzTZg3iF0YF/iRk7irG80Y/f4gVPgVXLLBsGoKbW+Cu2H8gPwHIegDzS9FXi 8cy0LtRbHWqEz6FZwt083N2Nu8dwdyd8vBEeOgqcAo94FNH126bRxC+g/kPEw8uQ1/O+qfsT 4updajTmlsIVo43qv4SIugL8r5ixJWgzFj74LuT7wHVaHLZTPfTrR4D7MfeD5Zhe5fkxIqqL S3ksphaWTVMxrh/B92X4xQBY2r8zi3nwo6uoiWheXAnvYJ3NxkbiMnEbxxOMtxVjeQktC+B9 3zJxtL8L8jdYpmjD8aQQ9bVaRGJ5KNrMhrxO9Vy0/xPGcgA610N/P7zr+4hIHeBH0KsCYyfP NjPtPsyqJSwwnSDejJZTIF9B++1aJGSvX6RGM643bMQ8bMTdw+CnwLPB/cEj++WAG/B2rgmz FVFUYTkbnAXND0B+XNtxNpM8HH7xDmpSwCdN97LlYDd5FZ51F+8gutnYm8K8U+iWMxuvwSOu 8lPGLPj456iRwKPgBZdZg+Ee+Ncw7GXj+02E1bEN7MB6CWj5ETzuSfZBsvZdiCQqH4QX893p uFuKKPRvmrdy/TjU78culsf6aV3eQiRkixqPHbMRfRiKERl4RIZn0OZPqDkmUvaom4aaWZiH 86ZPia/gqWLEqFmoOYeo9aDpXd55uefEakR9EbGF37UVvA683/Qg8a9N3yeewv/Hed3vEHlO 4e5ujT3oIctFpjG4ewFRhWORBWukmN7hXqG3r3C2oPt35AyJWJfPUP86Vm0ks6Du7x2ci+qt IutvFc3EnZzd6UcwC114ox/j9WGMmzkOGB5FDHmI2ZAiUo3+N9D8Mlr+GJr/N+QZ0NwCq2hh nbpc7q2wHX0+D55tHEA1f0UeUgjNT2Kl0qGnVc1MOJulDIrltfCUVcjrzosO9J9t9X7crUaf 38G73oG2RB6j+HueByNmQ/yU2RDCKiewNsO7LItPQs7GSLvQ/08RwT6FXyeitx9B527uoWEC Rt1f6y33JBXyWJFOLrrDGPWbIuXbwkX07Qie3YE2k0QXRww8VcT5sL7I8BfiDeLTpHkyVnCH uIhtW/8yyW3Q9qHGrO1V6HlcmyWR5A+Yyd5GCpyv0gwY+mEefoanfOC1sIROkWdvG2p+jhUf DW3PoYcS5CBm4BXM9jSM1IFnPwSfAs+E73dgLMuNiyD3Z6vgnVTAegmbobMMXILeFkGnyVjF 8USzTB5vkN8rvIw210xpzMZPwO+C96A+FZxLGo6pWTq3pH2QeZLxPcR8lrPVvB163gEfhp7D 0HMYev6A9jLay1yj96AmCzWSmuezTDvdJ+B3wXtQnwqZ29+lngXwlj0qI9t8Bnqe4Wf1z0J+ VpVZD/Ee1KeCR6ImCXZ1EDPJOj+AtsvgOvAvwA0i79czoHMGdM6AzhnQOQM6Z2CWZrBmQzq3 NKRjBvZDw37Ib0B+g0dBs7oZ/Wf+pTpelqlvm6FnM576BBq4ZiL6+anG7B17RO5DofEReDGv zosi76H7tPMUv+Wg2A5fxnmKWwrq2ecsTkMjcG7KAf8G2kZA/xVwO7gBz84BZ+PZZtR/CG4R yW5NqTwuUz2z6OA2YqtxJ0UAvMvkM/IOOA9z5cEM/BXtzTyrpnr4+6Po7Tuwkw/Aa7WT3XtY nUOwyfewau9hZmCf7H00A6N4pYz3EG/CKVKPlslo+Q7kFXh7lmpvWIufc43BgJUyoP4ZtP8A /Cm4DnwI55060zm8hWs+53Wh9WX5nMZYa8jNquVwDVlCLlYwFytOJ3dBNvyezuDjjQOJQ6bv 0Vke/vjZB8YN1P5l5HVHeU7EJ3gnEktZNrwO/iHq6zh7FF9FtER7yv85f7sPz85E/uZEy7f5 hC4e5uhtwInb8KyRYqA4BHd/iad+ytzvXtQnQMN1cAPaF8NOlvJaGN7guTWchjwD/BizmMJr JKbCNirR/i1Y1PvMxq1o8xisIpFbGr6Llf0LZAfuPoS7w2Et06FBPd03gHPwrinIXl7FnpjN M2b4ADtLJaLlAewmhzirMdQgf16DvWkLs2EJar6N7KgLevaC28Dvgt+HnrPgVnAYe9b72Hmb mY1vQ14KVnP7K9ibvoOseAzyw/c1uQlcD64Ec077Pp86jecx/8+g5SDwE6Z/IVZPo0vAOzWu B1eCWcPraImsW3yDa4i5xso1xvmwinnIWsPgmeCXcJbxIPP0IcvNRr5dy1moOApW9Cu8Ee0N lRxRRdQQ81g6of8BjZvA9eBKMGkzPsSnddNbsJzDxgR6aiC01YAXgt+DzmGYgQrITRo3gevB lbjLo6vgGRP3sNxvpOnH4DmsH0+JGvMsvQP9DTwbhinIBpdo/ArYA14AhkVxRmcagNX/Blpm c4Q0PmA8TPLHxreJf4z6do094AXgg+BH2Opw9xBqDqHmu5wJG15jP9V9Exl4Mvir4DByzhSc 3Z5ATjsWOfMa2FUYdruG80N9NjT/EnIF57r6HejbH1H/R9YjzkT/T3ONeK/Gr4A94AVg9rIH uVfifXxON/1MtXz2C/1ZaBsIrkG2sAzeNAwndC+8YBPuvq/xK2APeAH4INrQfIpf5rcY3+Yv wMTcBmd/YpbV7xhXMEsnjfXwiGS+qzLO4+f4xC12co1xD/dEbIL8MWQRdiKi/RLjR1gFlfnc /Ts+d9NssFW0isvQN7ZYAfJO9Hwn7qqxdDJ4oHEYscDrZRxhKiB5C9cbvwxL/iO4QouoHH92 I6KuQ5tVaP9z+N1f4EcDEVcnIg5XQ/4Vx2GyK3rKuA/rcgg6mxFp10NzGbSNgdzEZ3axGHc9 aLmbOW4PW3gczmjGH0HzDbaWfmrM/y1OPZXw0PPwoDfgHTjpk/9yDPkFNPwM2gTx2/TUbuh5 k/sm4gxOkaoNa8E7aSlO3H6WSUMXuA1+3QVug7d2gdvQ21+SjO+WYjNm6TpnAoaXEaMOg0X0 7Vd8Ehd/Ag4wG/BdyHDUtJJ3PXjxOshvoP2reBZfQQ2VXGNSOBqYnKh/G+3PgJ8F15iuMPeb y/sd2vyULaffvZATwI9B23W0x1dTcQDvEWI8f5ETHzEmwn5Y1nPfjBd49cV4+M4S7VuZF3vl EbYTrhc/0E7rfMKqxwnoCfj1DN4p+uVg7d7FSj3JsmmA8S66exU7104+L5P1ckyYznf75WB/ qWFvoni1C3wQcWkXmHfSXJy7x6D+NOpPo/5j1J9F/fuonwdtf8Rb1HPZEuyPbeCd/F7jGR6R Cd+xDY04iW/BTrcR5/Ff87mbotwCzPCn6DPHpSf4DG66C17fBe/eyyziayfFmUfQE+ZW3B2I 7Gig6UnEw8/gC68gYvDdpeBKLXrwU+8hbrzF53FqU436avQf8cr0AslN6PPT4r3E/4tZTMH8 b8dI/4DVCaHNbK0l1yTjTPQbHqM4lE/QBpzWDeqZ7gTOdEcQk/8V85CEdX9YPX3DWoYbKRaZ 4vDUp8gTXuNzutEh0vlCXIMY68azbjy7GnIdv0v/FbyxBOvyKs6G38HJtw2+IGJ03+czuzgG PXwOLXHCNaA/xhWQl/CZ3VAOWW1TBg2Z4G9wvkR5I/vjTvEe3hHQtw9h4eop+2uwgRkY9SOG 3TSiuazHFAAvZhZrxF8gZrIvPMWyMWKMoFc8k0VoIyBq7UEcM/Jdg5/3L6MOeoZg5neihz/l 87jhJOSP+RRveBTyDD7FG/4NYxnMPTHCd8TZ4giq2Yz+LzN8TPyCgWxAPM9/vmb6CXLC5/kU T6Pj/tzLZ3nDKuj0a8xzeBd4Np/fjTvB/8LnCMP/5bGbEjADuTiVd+CpYj6/G+6GvBd3L6M/ f0YPG1H/H/jTnxSeGdNovH0yeAHG6wJnarkl76cj8FQLn+X1v+ezvOE7mJ8R+D55Bj18HpyL 1fku1nEmrxrZLbH+F6hJQj+rcYpZB56iyjihrIOXrcNJZx2fqugunUSMDyKj3oeW3wK/Yfw2 IiHLZvBMlaFhJjTMhIYZaNmFs94YrhHHoOY91FSLEf5SgZNyGnglzstfx3n56ziFPYHz3Y/5 rESWQO31Clq+jzcmIPN8GNoe5mfF6ZBfVBk1L7I24j2oTwWPxJ5OM2N8B6NziHQqNGz6L/bO Pe6mamv8Y8259t7Psz3mdnkIIeReyT0hSYrKEbpJ6pRbyC0kSZJUkiSpVHJKKkm66VRu3UQJ SSohSZLcCUns553ju9b7e/Gez+d0fuf985w+57vGGnPMMeccc8y59lp7PRs+z8Z/NLpm8Ha9 9/T9ZxT4PA2fpzHSXYx0l8YqvEo9J1smVsG7NYvw8FpE4tMFuTVxODfZhlgpL+X+fa3ev/tR tNFnYuEXtNuGFbQOD7/irY1ep7RXfs9RPhVW8bwuHOX1Q9lLuV/299daej8si6ZZONrLA0Lt 2xlo2GnDcszFTrhXaZcqEyuU4RnwLq2bqEUrJfB5EWwMp+NtTBQrPOyG1YnwbbCv7nWpJRqB nLbE8xD3fTfxbUJflVNJrnc3aGmiGhFeimVL5O4qp5aot5y2+pkkkeV+8GzGFeVGI2a5JfMy BTkfD02xeVmfD9jrNf5hGWbhNXKjol6/7BYdnX0FuQjyCGw2wDOoVQnmM5sltW5ims54Yjr6 eli+yCzfr7LZiebsZEOod+69sSyts+nz5B72QOVKfM5CrkKf84nh7ar3lofo7SFWqL6Z0L/g JQmkesGn+oZDwSv6PT7sC6+GTQte9OxaUAP9GH2jAH2X2PIlOA0Pw6g1DE0p+LDns7GH2bQ4 G/02fY+iYBb8jrrKfgVrPC9VvWlfoE9Qz4D3wCHwXLgGjlAGRin70dSForQ9kB+FL8Cisazf RHxD3V/RPAwvoNZDyPmUboSH0dCK6YBmN3LkvymtH4TfUvo7XIA3i81F8Ar0P8ay9mEGmlfQ tEIuoFZN5C3wQ/gW3I5lG+RDyEnkLCyV1W8oNmVr6mdF+oO9PKwaG0WmLCyjmoBRB1fBz9Gv R54PV2ITRa999jzvoT7yZSqbc2Ef+AytrEQWpe+Dyl3ho/CFrH5qfR/Pv2BzB/yA0qfwPzka I/JJyBOwyWJTkVbeRS5L3+ZQ+gWWW9HfHY8Om4Ic72dYFAcsL47r+ijJIWJ1J/q62baM0V/f TWGlbEYeA3spg6/gAfg7Nh8hZ+ERLN+g9aqwAqwDf6aHUX5ORP4Jlsm28LwcuTjzPjrKWNWb 2cinZ/Vu/SvkxujJGZNSJsnD5K3K8F08HNXIJPuqnFhKJoxhjBsLntJvS7F/IMocvE2kD79h s4T4tNeV61dcKVaHcgL2pxz1n3yCPxjpWbAt7ANbZg2soKNT+kgq21A6As9tVOPzRPXV0dcl emvgQbhJS21NSrvCR+Gt1Koat6WWz8MP4K+xrDZ/zeoT7EHIxVVvb6Z0GdyPhwaMqFQ0L0SA +QrWRjNIZP4WrQ7kbtjMIaqror1IYxuuJsLRbpCPnEMkP8T+w2xzfeqF/DX6IXi7Bc3TShvt DL+Tz4eI9sOUkgM+29VnUepuJ/4b6H+SsSxFLoO8VePv81DjvxFujfUV8FOBPjxJDzV7X4Xv wu3oo/g/AK+AN8A7Yznyqd8UPIL9HPR9IXMke1hT24jb03B5QXHPo4wxjeZ15HKsyvlkRTv0 Kxj1VkpLM/btBTO8pjmlg9BPJWKsKVsHuS4eymicTQ300br7FP4Vn93x0B2f76AphxztrlEO LKM/PxNndrYgZKaa4CfajVdEe1dBPY0h8tJoH8ZyLJanxvuwtvIFetZ4OJIVugT5t4JWvp/R tWwae91XGqWwCfKF6Hfh5zdkdmOTC9kVTaVoZ8BmCXyb/r+abeDJ1Sr4BJs50b4B2WfMJKLU DJvVMNqdyHbDtclH1d/vWHaY4EU4EEY7UnX4OLwF/WCdd9sJzZWwN/l8G6UfwZfgJlbEqFjW aETXss7UYtcyXaJrHDObZC5KwYdhBfg5JH8Cri/B60opQJ4HD+NhZTxHKhPbYDdyfdiWuC1C LhxFGPkieEX2oPaTWtfh83Y4C8uWyOvJ/y/I/xWsizNgDfTTkRthfxd+uAJKlgzhGh1sJual sVlAziD7/ZDvxZBnoe+IHO3h5EByJnlVBHLtS/BJKVkeb9Fudir9fKtgin4LhoeC7AOM0TNY TOmCKGLs/B3YhV6B10W5xM6zlrEYmIbd4j1cd4Y32W/z0TTF20F2nkWUriMaf4ML4h1D7Ymb j/mT9CeSK3CNVpuR8Hb4RCxHpX2IsMol8L+cuoeweRK+haYdz0gP8HSxLHLb5Js+2nnxt076 Js8I3oY6yhPyGon5ml1KM5Nvqz/mPprnbMFPob4T9T53l3xzZFomC+nOwLdRK1Q2HyDvC9dw 3833d3qvUXDQ1BZ91p3Wq1vYS6/14XP6iQi5ZLhX+68Mk+ELXrOPdycOK4N7qdVDmVjF85ky sEg4XNcyHuorzdTwU+7O9vJNqNYaADvAknjLhmW85Rv2ds/FdpPumchD9G+pTEel7WA36D2m WspCZeCotVgZrlHazvZBr5lB3bL6VMS8Qd3OlFZVJtpRay1cCsfCzVa/IVprNeZd7DDtvz6X 8N5U0zjRCRu9C5ivGnlGZZmDZhLyYbUPD2K/Uhnst+/r6Oxk3c+xnKoM5yKPhGXRbKLWLmWi E/JYWAx2jDW+V6a2yrak9lYeo25vpR2mDKbTE2sCZWK//qYSsjFGNcFCSvXN9nqBj3P2D97q aWfG6i6hz4vMfPOQjsjcp/03z+t6V9nca+7VzDR6ta2g9sGrcLzS3o/NAsP7Y2aC5yP2fs/X kSfYF/GjclEs36XFrtR9DrkOTBn9LvsorR82xXV1G3LAlKKfRTTbDe8nmKTXnGcyurpNNb3f UfugLWyvlANKa/HQGm9XmNK6V5jP8RnJP+o1ReVgFpZt8JCl7inIW+AHgb+jDObQh22BfqtY K9Cnsn6/9JojgX4/fjTYr1cHXVnBfuSLw3z95BBs1P4og/NMSc/i5h29rgU/eQ9lYDFYS+m9 ecqPyBNgsWADlht0XSOvD4bplQWfnxt/ZxFMCtZ5/QvEOan9MWXx8zM8wHqfLOLnfUDoS7Oz kvnIPyAXVpnv5aclz0L/quoT+qTx2eR0z06wJdyhtFvhK8pEHvojShPCB9FUx+ZaZfIbLGvC NpRWQu6C3BHLLWjQh2OVqfLI1Sh9D+5HQyv2M+TuyCNhOzSj4FBlQG9NM0o/Rd5If5LYPAxn Uvox8uvIO+Gl8Gr0jMgepW7kbRm8G/aCX2FZH5lx2T9o8WbkRfTna7gNzXN460atRlguRV8R eTby08TkHeRb4d9gDWo9m/JXn+TJ0eyoHO6ABdEcqZzIQ3MEuXk0R2gmRjOlsr0WdoED8HZd NF/USkWzhkxMkrujWcP+FbiF0krKVHk079G3M7EcB3tH8aH18+nh+1FMVGPKIkcRI87hNNiU Fol2sJdSImnm44GsS0yCi7F/Bq6Cf4GMOowy7Wn6OQL7Kngg5glHH8gfU5Xcy8V+MzYvI5+L ZZRjLaBT5rysdXNK0E+LTSs8vA3z0Z/MqKsTmaXYP0opayRcTa3KtEVs7aRo3RHDb6hLbMOx sBp+3sSmNv6JpzmPunPQs8oSUa72pK1oJZaPcg8/y5GxNPdTazs2j8AoQ4ieHRhlMu1WJFaz lcFeNE/RVpSHDWAT2J66K5Hr4aEu/Bn+jv5e2uqKfBl+GFeC1hMNsRyPn8nIRN6wP4TT4RB4 BTZRi1/CKEPmUXoTZF5saVrsD4l8Ck34Ky0OQx/taazBMFrdrNxEBk0xyM5gyQqLNxPtVOwq Zg/21A0Hw5fgDPTR3ohsP0ezBHkDrZNXlrVj9lGLrEtEqyka0QJs0thPQRPN+0L0HWAZSJ8t e2ZyDD6jXpEV4TrImgrJjYCeJ++k1u3YH0ZmJYbD4Rr0zKkl/onO6NmjQnatkHww7OphDzgX +/3kzEjyJ9qvZkL2ogTryN6NJto5d1E3mlPm3TJTSXLJXgNZa3YCJHtTK5Q5ZEWC61eCbE8S 7RRjT1IaYm/Zo+zZ8FJtXUTvU8Jns/qdVyfYEu5Q2q3wFWUiD/0RpQnhg2iqY3OtMvkNljVh G0orIXdB7ojlFjTow7HKVHnkapS+B/ejoRX7GXJ35JGwHZpRcKgyoLemGaWfIm+kP0lsHoYz Kf0Y+XXknfBSeDV6RmSPUjfytgzeDXvBr7Csj8y47B+0eDPyIvrzNdyG5jm8daNWIyyXoq+I PBv5aWLyDvKt8G+wBnVPpm4BNs2RJ1I6APk69CnIWJK74ZmUjoO94fnUep92y9LDqOeMN5wG m1KXUQd7KWVEZj51mf3EJLgY+2fgKvgXGPUwmvFoXCNgFTww9oTDJ/NoqpIDudhvxuZl5HOx jOa6BaRWDqU5JeinxaYVHt6G+ZQ+ikxmhquxqYxnImPpv32T0tr4ITLmPPRz0JO9iSgHeuIt yvAoV5ejx8bcj2Y7pY9AZscQBzsQPoW3aB4bwCawPaUrketRqy78Gf6O/l58dkW+DD/0PEEr iYZYjsfPZGRiZVhZ4XQ4BF6BTdTilzCa03mU3gSJpC1Ni/0h0UuhCX+lxWHoo92A7A2jdUHO JzJoikHWlGUeLd5MtMZZj2YP9tQNB8OX4Az00a6CbD9HswR5A62TCZYMN/uoRZ4kopyPRrQA mzT2U9BEM7sQfQdYBtJny26THIPPqFfMe7gOsgpCZj+g58k7qXU79oeRWTvhcLgGPXNqiX+i M3pWd0gmGHbCsAeciw1ZHUY7yS7kaKaYTUv8k2SIvQaS83YCJPdSK8h/5jrBfp4gV5PEMMWI kpSG2Fv2B3u2Um41O728L1wh+leZaZ4GjPeaPL0ft830mYMdzfOEiyidmkiIvheRr7nHUxSj GvML+vG8d5fkGUiomuBJ9J2ViVXKsBb2ZfEwgNKtyuRA5B6wNTa78LCf1jvGTzYqex7SJyfm ZjSHwlrqh6coP/AUpWH09APNFp6lbEK/jLrzeWYyFJtdcEj0/ERHbfrw5OHyhP7tT32lLcJT lJVaKgUqB8XRzI9ktUnkE7EK6HNi6p118XCKto5mBlwMqyqzEwv0eVS7ghXqDbmj3smalSoH FyB3orQl8gLkNVgOR85BbkzpR9TahqZY5A3Npqz25HRsilGrNuxC6dcRKS2DfJjSJ/BQGf3z 6Bsi16Q0iXwj8n1RH1QOvo36QOlQlbMdCg76CFRF84bo04m1yFNVthmVpUBpm8F9aA4jc19v vlcmVinDAL2BsyjNUQb7kXfB2tgLNuNhTTia0iH0YRJyF+QZtLgdm2HIn1DaBz9p9D1o5UM4 Pe6/9qc3mnfQzIdjIeOVUdnVOgvZeZqHaIZm9YlfBTz3i/ug+md0jsxmpazH52w4gdaPYHko 6pva2I1ZfbPuXPQt1b/Zm33R67PSxveqCJY/qMbswc/l+P8Fb53VPlkO/QMqW5N93bOk2oeL onbx2Yf4TFW9b1e9XUb/Ty447DVN6e2BaNRqn+hAu+PIt1rYb0bTT+Mge+h5nuoDB7PZI16/ XGmGwI7K4EO4EW7DZo7Snk9/OpI59WFJWl8cz77XSKesrsplRPgZWJ0RDYzyP5rZqCfoNypz 8JNi9flPv36MyVLUnaly4sJofrXPiU6MaE48C9PQz+Oz3+v6DDnKxngs+5idI8RnHytxABp9 jvoDcm08TCJixZG7UKsY9ouwmY/mOuR+6CcQmQnIs/FfFvkDbAZh/wbe/orGYv8mljlaGo6h n4zRtiaTWdHyFD0JlcnhjLqtRiCcojRlo/XF3H2dncXszNL9nFpZ4rAx5jS9mqDfr/R7vc7d T/SqKpwBaxONZfSttvbNz2yU1fv4lkFLN8Ml8GssG+PZxd72sYI0T2Yy0hDNHOzXodmBPB2f zdFcDK9CfySeqWnIqhlBK1OxuQ6+g01j2DZe73V9b6dFo4hzT1fN8mivQL8W9sdzzygPo2gQ n9dYfbPIpc7Mwgt47hjZU7cxnoeieQfNIexLSoZoTCMHNOZZIpyD/8fwtoN5vE4tfc/n6Txq n/3navXQAfs3sLw+so/3Q23xsexk7WG8Zwr7NuOVx2hd/ayIMoSV+HeeG++SbvopWmm3FrT3 8pWMehs2A8ix9bobJMahr0T/L47zSqP3htE3zbqhGUl+nom+LFwb7aXsNkMZtUM/BObAGYx0 DGMcEMWWnWomMW+EpjV73Yiob7EH3T8f0f3T91AzvBSRrItNT9o9HK/WF/lOP1p3R9iZS9Pb 6OoWXV80hu10LwrnMooKBSMozZA5nkmuWakZ0Z5D/Nuw5zSFh+NV4NtKse5sx3iudZ9pHsUn 3g1Uv5KVXhZ5eLxzaulT6PuQtyWRL0HfE5tlyAPQV+dqlU/+vxPvwPv014QKNrFbdvClK5nZ M6MrV1Z/I2VOQQmuaN109nU38J9VOrBXlCcmntkq6kGE3w+UUP+2KH66qJQ0+rTqRVSTfVzf DM8u1Lf3s62QxyFfgNw31j+tz/P1/X+vmUnpX/XdNv07Ai9/jLwLeYfK+jdH2f76znx2Ivr6 +gaj9/Ayv+SzXPQXk+Z7TtbvMaWd/tV/9kL925PsKP3rlez8ZB/PdSlf6+gu5JNU9v18yPPb 1B7tVXKztpLajbxO/ae2Iv+BrDb99a9Lstck9TeaHk/dALvp7wLRt5ZRn5P6a07DUn42s3cl 8Uzp3clt9Hwj3opgqbwr1Vzf8Uvp7xGNytFvPZokRhOZOUTge0aRUQ02j+d00ncIk0s9H4t7 61d09rZUY9pS/W3Jw/i/Bv9j+S0j1Y9G31rfz8+OTj1P3dO0b6lr6L/KI5FHJT/xfC91yLMd +kfRX5is6jk0dSVyDfp2NaP7Ru1zUkRJ31GcmZPDPGrdZ6jbKnk/bb3reQZ+euHnauRHkVvp 7wB4n7fiR+WZzFSrZEk0PmOzDyYPaBxiquYt5FbI/ZFbJ1Yw3v3af/KtPWyV0NJrYKvUaeSV yk2SL2CjeXgOGVhDv6/083sSsT2JnitvSr2K/jXPW5DvRu6fXEgfFpJF49CPo8U34SNwIq2v gl+gWQVVHkR8BrEK6vFugBwt8PIp+rZAtpB+X5+tc1R/maoclKO6Oqrpd/3ZOhGP+rWfLXF0 gWdVNOWyd1JaAT8V0OAHn3WO+vWb7R75Oap9qHH0afS6Fsof/Yi2vvbMP7oLjfIUWOfot1D3 mbpHf/Ysnm3BVUIkHTyW20Zs19sG9pH8Gwd2v0lG9blhcD95R/y95WUdWlQQv1MWFEhJyZOk lJVTpZjUkgbSWM6TS6SjXOd9dPD7Um8ZIENkuIySMTI+rlFYUlJOKktxOVMaShNp4ff9q8XP m1wm3eUmuVlulTvkbrlfHuLf2IxqOcnx+1kVyZfacpZv/Xz5i3SS68XI5dJD+shA/kXQ0TJW Jnhre1G7dq2lTYdL/1JBelze4ZIKMhU/pfi93FP8FaKqlJA6co60lNbSVq6RG8RKTblCbpS+ MkhukzvlHnlAHqZWWipINdHrbiNpJhfIpXKaTKSktBTxpRWljFSXk6SenC3nyoVykbSTztLF 9/50uVJ6Sj8ZLMNkpNwr4+SRuB9FpZBUkpOlhpfrS3NpJRdLe7lWukpCzpCrpJf0l1vkdrlL 7pMHZZI82rXuoK52JBwDJ8DJ8Bk4o+sNfQbb1+BcuAiugGvgpq43DOpud8B98BDMKsMQprt2 7TsgLALLw9NhY9gaXgm7devT68ZwABwCh3fr179vOAqOgePhJPgkfAa+0GPgDV3DWfDv8H24 FK6GG+BW7/iGcB88BLPKRNin3y19E2lYBJaEZWElWB3W6tO/a59EfdgYtoCtYVtvMjBxOewE r4c9YB84EA7tr95GwNFwLJwAH4NT4LT+A7v1S8yAs+GcAaqfC9+Hi+EyuAqugRsG+ZlKbIbb 4D54CGaVyeSgXv16JPNgMVgKloeVYc1BfbsOSNaGjWFL2BZ2hF0GDapdJ9kHDobD4Wg4Dk7y rJucAqfDWXAOnA8XedZLLoOr4Xq4Ge6A+z3rJ48oUwbmQAfzYRnPBqkKsCo8HdaFjWCzQbd0 GZRqCS+G7eCVsDPsMuiWAYNSPWE/OBgOgyPhvYN9tFPj4EQ4GU6F0+FMqJ/Fjd97SvwLR+tX d1kp9/8l+c9k/5QJ/1/S76U5/Jjw/81ZyFkkB1Lhf9H9SVq/u+X5nf7fkwK/U/9jFv/TtMyI 5UoSCE+vuMLp/5WF/jSL/WmW/18s+qdZkf6GHINjqD0/Vpf5p7T+inWSv0L9a1IpJOOvTaf+ S8fK/tr8rxz131f/88dAqv8J1vgT/OdxC/zV/J+zyJ9iPX/1H+o/+0yWGf6z0yeyRrbKoSAn KBVUDxoFrYOOQc9gaDAmmBzMCN4JPgnWBFuDQybHlDJ1zfVmvJlqZpuFZoXZYHaZrHW2vK1l m9m29jrbz46w4+1UO9sutCv8+tX2cqLctv1OOB91wvmkE84XnnD+/jHnft3YTcecJ/2WUUtS wTHn6bHHn+cdOr5+ps3x/vNfO/68xJXH+y/R+4Tz4SfYTz3h/I0Tzjcdf16y9gnnI044f+GE 8xXH97/swePLyxc7/rzKmBPOxx5z7tdtlXEnlG/g3PhdvFg0wmqzomP1AZSEfg8t6XeOqpG2 xunxsWF8bB4f2/wj69NcfCwVHyvFx1rH9+K03seP8vSSx5/rPyxwrH3dTsef1994/HmDpSec Lzv+vGHPE857n3A++oTze084n3n8+VnNj8k6LzRuccJ5t+PtG/c44fzE8qEnnA874Xz48bN6 zlBP5yPVNXhUegRTuMp08f9JMCmYpM8ZEyW8Tv9NUJtIJ/IShdUiMIGvy79BGvBvkKpFMUnm PZTJyxufSWeSmRyvSQY7g53ebk+wx9vtC/aJCQ4EB8S6+9x9Err73f3+Sq0ZZOwFtrX2yBQz 2l4RSfh9orgtYU+ztf15wha2/lpqi9giEth8m+9r1LQ1xdoz7Zm+90FQy4+opL+rGihTZLFs lMNBvh9Jjh9bft7jYvLG5032fCjvCc8JPgZF/DWigt9xa/u7t6aZWmJNEd/vMznmZWr7Ywl/ XodjXqasGH9W3jMvU8FTI6Z5X0YqZaqK9eNNZ6pxzMtU98ccf16DY94xljVjy9Niy9NjyzNi y//u78P0dyL9fYT+/nfJJEoepeSxY0syRehhMXqYTw//u6QkJaUoKUOJkZTx//nFW8jou/BF jK9tSvjI27xxeQ9K6HuXFD+HfhZT3k9g9Fve6FOB8NvnNzCnwmwGweHgsJ/ZgqDARythEhLi N4HfJH5TpowpIzmmkqkkuaa6qS5pe5G9SAol+iT6SF6iX6KfFE4MSAwQl/B3KZJJDE8MlyKJ EYkRUjQxMjFSirkerocUdz1dT8l3vV1vKeH6uD5S0vVz/eQkN8ANkFJuoBsopd1gN1jKuCFu CL+pf5uUdbe726Wcu8PdIeXdne5OOcXd5e6SCu5ud7dUdPe4e6QSOXkqOVnZPegelCruOfec VHUvuZekmnvZvSzV3SvuFanh3nBvSE03x83x29Tf3d/ldDfXzZUz3Hw3X2q5hW6hnOkWuUVS 2y12i6WOW+qWSl233C2Xeu5z97nUd6vcKmngVrvV0tB9476Rs9y37ltp5Na5dXK2+859J43d 9+57aeJ+cD9IU/ej+1HOcT+5n6SZ+9n9LOe6X9wv0txtd9vlPLfT7ZQWbrfbLee7vW6vtHS/ ul/lAnfQHZQL3SF3SFq5w+6wtHZH3BG5yGVdVi7O6MeESzI2Y6UN8/0X5rutz5W0XOpzJU/a ZZzPlvaZIj67OmSK+ey6LJPvs+vyTEmfVVdkSvmsujJTxmfVVZmyfo10zJT3a+TqTAW/Rjpl KmcqyzX8nn3nTINMA7k2c1bmLLkuc3bmbPlrpkmmCc89Rvn1McpnUibIyJ1BmaCcjGRfGR10 CjrLPUGfoK+M4d8zHhvcHAyWB4KxwVh5yH/WeEImBHuDvTIxOBgclEeCP4I/ZJJuRPKoSZqk PGbyTJ48boqaojLZlDQl5QlzsjlZnjSnmlPlKVPD1JApprZpJ0+bweYWWWhuNbfK+2aYGSYf mDvMCPnQjDajZZG5z9wnH5tJZpIsNo+bx2WJmW6+kU/8nuTkiK1v60vWtrAtpUBzOjD2aft0 YMPB4bNBmOib6BvUTfRP9A/qJW5O3BzUTwxKDAoaJO5I3BE0TNyZuDM4K3FX4q6gUeK75MTg 7PQT6ReD3enlhVoF2bwr8x4wt+U9m7fZvFp4ZuHXzK+FPy68yhx2rV1bm+NudDfajOvletki 7iZ3ky3q+rq+tpjr7/rb4u5md7PNd4PcIFvC3eJusSXdre5We5Ib5obZUm64G25LuxFuhC3j RrqR9mQ3yo2yZd1oN9qWc/e6e215N8aNsae4sW6sreDGu/G2opvupttKbqabaU91s9wsW9nN drNtFfeme9NWdW+5t2w197Z721Z389w8W8MtcAtsTfeee8+e5j52H9vT3RK3xJ7hPnOf2Vpu hVthz3Qr3Upb233pvrR13FfuK1vXrXFrbD231q219d16t942cBvcBtvQbXQb7Vluk9tkG7nN brM9221xW2xjt9VttU3cNrfNNnU73A57jtvldtlmbo/bY891+9w+29ztd/vtee4395tt4X53 v9vz3R/uD9vSHXVH7QWuwBXYC30CBrZVJsyEtnUmlUnZizK5mVx7caZQppC9JFM4U9i2yfj/ 2b9kimaK2raZ4pni9tJMiUwJ2y5zUuYk2z5TOlPadsicnDnZXpYplylnL8+ckjnFXpGpmKlo r8xUyVSxV2XqZerZjpmGmYb26kyjTCPbKdM409hek2maOcd25j4v4PNUffba0/TaF1wbXOvV 3YPuEoRvh2+LSeWkcsTmjM4Z7VfPf3bj/+zG/ze78f9kXxmyTz+xm6BX8qf/5Nh/cuz/KMeC RG//mb9IUMnUtxeGHaWsNJYWcrF0kE7+rqO3//w+zH8eGCsT5UmZJjPlDZkrH8pSWSVrZZNs k33+k70EySAvd6HY3Hdz5+a+x3Fe7vsc5+d+wHFB7kf+ONdLizjOzf2Y47zcxRzn5y7huCD3 U3+c5+2Wcpyb+xnHebnLOM7PXc5xQe7n/jjf263kODf3C47zcldxnJ/7JccFuV/54wJv9zXH ubnfcJyXu4bj/NxvOS7I/VCML/3Ec17uCs/5uas9F/wbEVnHyN/NXR9H5rs4MhviyHwfR2Zj HJkf4ohsiiPyYxyRn+KIbIkj8nMcka1xRH6JI7I9jsiOOCI744jsiiOyO47I3jgi++KI/BpH ZH8ckQNxRNb68b+bu5mIbCMie/7NiPwWR+RQHJHf44gcjiPyRxyRo3FEsnGuFESRSUsUmXQQ RSZtosikbRSZdBhFJJ2IIpJORRFJ50QRSedGEUmno4ikC0URSReOIpJ2UUTSmSgi6SJRRNJF 44gcJCJHNFPSSY1IOu/fi0i6eBSRdH4UkXSJKCLpklFE0idFEUmXjiKSLhNFJH1yHJGycUTK xRE5JY5IhTgiFaNcSVeKI3NqHJnKcWSqxJGpGkemWhyRGnFEasYROS2OyOlxRM6IIpIuphFJ lyIi5TVT0tX/zYicGUekdhyROnFE6sYRqRdHpEEckYZxRM6KI9IojsjZcUSaxBFpGkfknDgi zeKInBtH5Lw4Ii3iiJwfR6RlnCsXxJG5MI5MqzgyrePIXBRHphYRqU9EGhOR5pop+i+tar95 RtdRagSrzN9sG3up7WFvtL3tTXaQvcXeam+zd9gx9n471j5gx9kH/b3LJvuj3Wx/slvsz3ar /cVus9vtDrvT7rK77R671+6zv9r99kDh4fpvoAUrg5W+gan6F9D2EnuJGNvWthVru9nuEtqe tpck7UA7UHLsYDtYcu0QO8R/Ehhqh0ohO9wOlzw7wt4the1T9ikpbufa5ZJf+PbCt4ufVf8p JB2WD08JK4QVw0rhqWHlsEpYNaymI/M9OsCz/kBKHfNs4gx9ymX7qIWvWS22KHuMRa1jyvxq tn28tYT5of5SXPWwuhSK280PS4Qlw5PCUmHpsIz+MqK3+J929RuATFgsLB4mwmSYCnPC3DAd FgrzwsKh87cQRcKi+v2HH9udvgtax4TnhM0kLzwvPE/0CUxDKWVfsDPsLPuqXWQ/tovtEvuJ /dQutZ/ZZXb5P4q4PlGzz9vnvccX9W/H7cv2ZR/v2Xa2H8dc+5Fvb5Pd/v+8P++tXvalc+08 O98usAvte/Z9+4H90H70j+YY7y/YF7z3GXaGvlVoZ3nvr9pXvfdFfl5CxqHea0n+P/T6D8ZB zDbFMdN6fzK7qKfZ4Osl+pk5creMlnvkXrlPxsj9fl0/IOP494EfkgnysF/lj+jbBfKYPC6T 5Qm/5p+SKfK0TJW/yTPyrN8BnpPp8ry8IC/KDHnJ7wcvyyx5RWbLq/KavO53hzdljrwlf5e3 5R151+8V82S+LJCF8p68Lx/4neMjWSQfy2JZIp/Ip34f+UyWyXJZIZ/LSvnC7ypfymr5Sr6W b2SNfOv3mHWyXr6TDfK9bJQf/I7zo2yWn2SL/Cxb5Re//2yXHbJTdslu2SN7/W70q+yXA3JQ fpND8rsclj/kiByVrBT4hA5Me9PBXGYuN1eYK81VpqO52nQy15jO5lpznfmrud7cYLqYrqab 6W56mBtNT9PL9DY3mT6mr+ln+psB5mbzjFljvjVrzTqz3nxnNpjvzUbzg9lkfjSbzU9mi/nZ bDW/mG1mu9lh02an2WULmd1mj9lr9plfzX5zwBw0v5lD5ndz2PxhjpijJmsK/GUwsMZaG9qE TdqUzbG5tr3tYC+zl9vO9lp7vb3B9rU329H2Hnuvvc8+Yp+wU+xr9nX7pp1j37Hv2hX2c7vS fmFX2S/tavuV/dp+Y9fYb+1au86ut9/ZDfZ7u9H+EDYJm+q/vByuDr8Kvw6/CdeE34Zrw3Xh +vC7cEP4/X+x9x1gVRxt2zN7zp4ZzpajgIKKCGIBQTn0KooUFREQEBQBkaYUBRFLFEVQLLFg jJVYsfdeYjcaxV4Se+y9K/b+zT6WYGL+5H+/N2/+778+53Ke2XKWneeZue97ZmfPUV9QX1Rf Ul9WX1FfVV9TX1ffUN9U31LfVt9R31XfU99XP1A/VJerH6kfq5+on6qfqZ+rX6hfql+pX6vf qN+q3/GV+aokmLQmISSUhJE2JJxEkEjSlkSRaNKOtCcxpAOJJXEknnQkCaQTSSRJJJmkkFTS mXQhaSSdZJBM0pV0YymbpRyWcklP0ov0Jn3IV6Qv6UfySH8ygOSTgaSAFJJBZDApYmkoGUaG k6/JCDKSjCKjSTEZQ74hY8m3ZBwZTyaQiWQSmUxKyHdkCplKppHpZAaZSUrJLDKbzCFzyTwy nywgC8kispgsIUvJMrKWrCPryfdkA9lINpHNZAvZSraR7crvNpOd5Eeyi+wmZWQP2Uv2kf3k ADlIDpHD5Ag5Sn4iP5Nj5Dg5QU6SU+Q0OUN+IWfJOXKeXCAXySVymVwhV8k1cp3cIDfJLXKb 3CF3yT1ynzwgD0k5eUQekyfkKXlGnpMX5CV5RV6TN1RF1ZSnGkoopQZUSwUqkuVkBVlJVpHV ZA15S95RRDHltFu0W7XbtNu1P2h3aHdqf9Tu0u7Wlmn3aPdq92n3C9uFH4Qdwk7hR2GXsFso E/YIe4X9wgHhoHBIOCwcEY4KPwk/C8eE48IF4aJwSbgsXBGuCteE68IN4aZwS7gt3BHuCveE +8ID4aHwSHgsPBGeCs+E58IL4aXwSuRFjUhEKhqIWlEQRbGSWFk0Eo3FKmJV0UQ0FauJ1cUa oploLtYXbURbsaFoLzqILqKb6CF6il6it9hY9BGbiE1FX7GZ6C8GiIFic7GF2FIMEluJwZKN 1ECyleykhlIjyV7SSw6So+QkOUsukqvkJrlLHpKn5CV5S40lH6mJ1FTylZpJfpK/FCAFSs2l FlJLKUhqJQVLraUQKVQKk9pI4VKEFCm1laKkaKmd1F6KkTpIsVKcFC91lBKkTlKilCQlSylS qtRZ6iKlSelShpQpXZQuSZelK9JV6Zp0Xboh3ZRuSbelO9Jd6R7DXcv3M7IwM5rPTecYgsJ8 50xVEOP3Y6rWjN9PqGJUHdApVbyqIzoDHHpWla3KRucY4xWg86qxqrHosmqSahK6Asx+FXjr GvDWdeCtG8BbN1VrVevQLWCIO2oPtSdGMG/K8TIvYz1vzBtjB5gZddTc1jzAN4gXaYLvwSzp I+0B7UWO094WeM5E0Ak+nCPMlSbCLOlcxvblyICpg9rIDoUwBVTCGGALQ2f2J4R9iNPpoFQO JeUZTSVUFZmJEtuuKTKW09USdSy3FA0/nisyBaBT1pgYsquaMwXQ4P3TI7GWsl+0ZHll0Yrl RmJdllcRnZRPyh2UK8qxyhXlOOWKcC0/uOqHZzRyKNsS5DCWS3Kbz460hSNRcCT6syPxcKQj HEmAIxwyYFHTs9i5c8pvbHlxXojjAjmmILmWXEuk5kK5UMRrT2lPIY32jfYNIoKr4Mqux/Hz uSN/E8d+zrD/f/Prf4ZhFQ79q7z5d3JmVZJFupMeZAhjIIU5wxhnRgObxTJmmgw8mcQ4UmHH 99yY/RdZceif8OHv2XA248FfGbAiu/w/xoa/sh1VMQ6f+xkrBjP1oWiP98pD0R0dSAxVv9cd VMNURzJTHAtAcywkGZRnrTaKtdSOSrv8yJ1c1895U4wSo8V2YnsxRuwgxopxYrzYUUwQO4mJ YpKYLKaIqWJnsYuYJqaLGWKm2FXsJmaJ2V9k231f5ls5VA6T2/wl1i3/Pe/KbeUoOfp37CuJ sqgDDjb8IgvXZDxcS7QUrcS6H/lYjpXjgJOd/pCV/X7Py3K83FFO+JfY+XNu9vsPsHMo5nAV NpStjq2RMQ7DkcgKnpRa43icgmxxZ9wZOeE0nIaccQbuilxwFu6L3HEeHo/8cQmeiuLxGnwI JXI5XC7qz/Xi+qOBXD5XgIZxg7ihaAQ3nBuFxnDF3Fg0Hp55TuYmcAztYYw/TSWqDNF0WIEx V1VV1QDNU9mp7NEmlYPKH20Dxv8ZGP8YjN6Oq0vVh9AtvgpfBZtqkAbhahpOw+HqGjZsxjU0 JhoTbKb5VjMR19RM1kzFtTXTNaW4vma2Zh621SzQrMb2mrWaLdhLs01zGPtrjmpO47aaC5oL OF5zWXMVd9Rc19zEiZrbBOEUwhGK+xEtUwiFxJcE4vWkBQnCW2gWzcbbaQ7tiXfQ3rQ33k3z aB4uo/k0H+9RnqLhvXQIHYL30WF0GN5PR9KR+AAtpsX4IB1Lx+JDtISW4MN0Kp2Kj9AZdAY+ SufQBfgnuowuwycNggyC8CntfO0CfFq7SLsU/6Jdrt2AL2g3aTfh24xtL+I72jcCj58wtvXB b4UWwkyOCLOEbVwn8apkzeVLP0kXuB3vV8KwMelSeO4Sh1M/7FlbYQ9GnsyN7xVIPaZsnNnx OSwp+VKmDeaAVbY2f9jazLbOsqSsx7HFtqztNMKNGOm5Y3d2zea4OaOYVrgVUuNJeBKsxylD nfg6fF2+Hl+ft+Zt+Aa8LW/HN+Qb8fa8nnfgHXkn3pl34V15N96d9+A9eS/em2+Mf8I/42P4 OD6BT+JT+DQ+g3/BZ/E5fB5fwBfxJXwZX8FX8TV8Hd/AN5Vvi8N31Cq1WvVU9Uz1XPVC9VL1 SvVa9Ub1VvXuv7NPzaqi5mC+QQ0rZivDMy1TllTIjCU1rMfkmffsEEH2LFHmVU+mFr1Z0iIf lgTkjwKQiFqxJKNolnSoPYphKjGeJUOUzJIR6sKSMeqBclEV9BXqi0xQPkvVYH1UdazDlVAN 1lOro5rYHJsjc1jZUAtWTFmwXhuDLOHZbm3or1Y4E2eiOrDWoS7uiXuherg/7s969nA8HNng EXgkaoDH4DHIjvXjEtSQ9eM1qBHehrcje7wL70YOeD/ej5xg1skZ+p8rKOsgmHuKh7mnBJgR q15hRswe1l15cUyhopqcA+fA9KMr56q8h8f5syNBXBDTj+FcONOP0Vw04pkKSkEapn8yENEe 1B5GVHtUexwJ2jvau6iS9r62HBkKZkJNVFWoJdRGpkJdwQaZMTbZiSwZl+xFdRSeQDaMJ64j WwXVkT1DdTPkwLDcCrkwPK+LXBmi2yA3huq2yJ2NtBoiD4bs9siTobsD8mII78Ri9du66KEu Lbl0Vhfzz+riwXmwI0qNVFwYG9mooUY81EjD1F4MIlAvyrRcd2QA9dJCvSSolyHUy1j7WPsU mWqfa1+jGlBHC6hjbaGhYI/qCQ6CC6uXUtNGUFMHqKkr1NSdseFt5M24sBw1gVoHQK2bM5by Rq0YR/mxccr7Z7DBrH8mQ40clDoq32mIPD/U0eHDOdas947BEz7t4/BCvJxtGX86j/WAL/jA m2N+A0+oIbY8+EMD/iDgDwr+MGDqNw5pwSsCRFsE30ja6drpSGbj851Ix8ZgJ1nMT2svIjPt beaVOtq3As9qrGOe8BHcBB+UwpTEAdSVaYbjqC/TCOWokCmAV2g8Y/xaaCrEfD3E/HvG4/XR Boj8Roj8Joj8Zoj8Foj8Voj8NsbvLmg743g39APjeT+0g7F6MDrIlE48Os7UTWd0jimabHSN aZM26B7TGNHoIWP6BDYOYEjIxkndEVLGkaiZMteA2ihrblCEsF0cgQ6yzyThyX/5PPhe0b/p 7E/tASVCVB2hzYdVaA+Ov7YHFIl8Pu3jUCAbof7aHhyV+W7tJe0thASNICMDoQn7a4bKXhjr v78TS7gH/Ye7/HivngzN/gV0Z5+s8mGtqIKFGLBQBVioBizkAQs1gIUEsJACFhoAFmoBCwXA QhGwUAYs1AEWVgIsNAQsNAIsNAYsrAJYaAJYWA1h/qTCl1yIahu/id/FH0ZN//S5EIe12JDd a23cADtiT9wMB+Fwdo+JOB1n415MSxXiYXg0Hsf+9gw8Fy/GK/F6vAXvxHvxYeahX5g3buB7 +DF+yWhIw4mcIWfKmXN1uAbM0664AfOBNfNIQ7AxjIcVG4c9wMZjT7AdsRfYBOwNthNuDDYR +4BNwk3AJuOmYFOwL9hU7A82DQeCzWTcrtgsHAq2hK+hWPVa3gzsOr6mYnW+1ESxvAk1Vaxm Ka0GdjetDraMwufYcAU+RwwofI5oqblimY6qBbZI1xz+Tjq2YZikY4qDY1t2LI9hukNRMfYs j8d6lnfEDKVYDVnbZPVzYnkiZoqG1c2F5cnYleUp2I3lqbiZshYF+7E8AwewPJMpF47VqgXL s3FLlnfHQSzPwcEsL8GtWT4Fh7D8O94Ucay+1Vi+jlfWwPpSCXGspjILz1KqY/luWonlZbSy srqKsl7B6mfEci01RhyrWxWWFyEb1sNiGfNnMsbPQ4PRSDQOTUGz0WK0Gm1CO9F+9DP6BV1B dxjKfHi+yFqSKWvxdVhb0mNX7M1aUwscgiOZNxJYrTLxQuatEuahRWDj8GKw8XgJ2I54KdgE vAxsIsN4xSbhFWA74ZVgk/EqsCl4NdhUaqNYVkeltZWwWtqC3U3twJZRpfWVsLo2AmtA7cFq qV6xrMYOYIvwNIjfdIjcDIjcTIhcKURuFsRsNsRsDkRxLkRuHkRuPkRugRIPagEetwSP1waP W4HH64DH64LH64HH64PHrcHjHn/B06+xmvnZGJsxL9th5y/4OAf3wQPwYPy1wpisVZTi+Xgp Xo03MMTYxZDiKMO0cwy/buEH+Cl1QipewDrqCjaGNgMbR/3AxlN/sB1pANgEGgi2E20ONpG2 AJtEWyqWM6RBsJ1CW4FNpSFg02gY2EzaFmwWbQ+2hCYplvkqWbHMWylgd9NUsGW0s2KZz7qA NaBpYLU0XbHMcxlgi6jSq3SU9Se2pfSnGKr0pDiq6P546qFEkXoqUaReSuSotxJL2liJJfVR okibKFGkTZUoUqVXpVGlV2XQUKX/0TZK/6PhSv+jEUr/o5FK/6NREO9opf/Rdkr/ozEQ+w4Q +1iIfRzEPh5i3xFinwCx7wSxT4TYY6SmVZU7hpLvx5IuEN5d4IFBEOA/Zv4S2OeVlydUukB2 Bs/OCYG3SqwZ83l/nDXFVQGHTAA/TJX7VK6Iq30qdVFqqbAzY5wJgCOQK09zcSXGYQhXYeNv DFzFAQMpymsK2sd87EidqDN1oa7UjbpTD+pJvag3bUx9aBPalDajftSfBtBA2py2oC1pEG1F g2lrGkJDaRhtQ8NpBI2kbWkUjabtaHvcFkfj9rgdjsJdtNOY5prx/pkI15MbwA3jxqtKVAtU K3lzvhZvwVvytXkrXTOdn86fYF0AjaEdaCyNo/G0I02gnWgi9aVJNJmm0FTamXahaTSdZjAt cFl7RXtVe017XXtDe1N7i+kCIlDBQNAKgiAKkiDrGsst5JZykNxKDpZbyyFMMzQVfIVmgp/g LwQIgUJz4YRwUjglnBbOCL8IZ4VzwnnhtfBGeCu8E5kLRU5UiWrRQqwt1hHridZiA9FObCTq RUfRWXQV3cXWYogYKoaJbcRwMUKMFNuK3cUcsYeYK/YUe4m9xT7iV2JfsZ+YJ/YXB4j54kCx QCwUB4mDxSJxiDhUHCYOF78WR8jhcoQcKbeT28sxOh9dE11TuZOcKCexuNmwdhLJ4qbMjDRk Y4NWTBWnc5nIgcvlcpEz15/rj1xgjbcrzHe4wSyGOzyr8FCtUK1Anrwp40gvzfeaDchXs12z HfkR5TUaf+U1ChRAJcZ8gco4H7VXxvkoUagj2KIMZbSPeggHme7NEx4xxVsk1mKKd7RoKVqi YtC9Y0D3fgO6dyzo3m9B944D3TsedO8E0L0TQfdOAt07GXRviejPFO93YhRTubNB5W4FlfuD 3IGp3B9ZzTegmL8S438xpn9D5D7FTAveROBNA/CjIfixBvixDtS8IdTcFWreBmoeCfo++v2s CS/zlQEngtAeljdD5hV70W/b9R+30PetiV2hMrQdBG1HBRHWQDxliKcO4lkJ4lkZ4mkI8TSC eBpDPKtAPKtCPE0gnqYQz2oQz+osbnGoxoe71/GGFe5eZmO1D/1eQSJouQhaLoaWy0HLVX34 bCXeqMJnTZma/oQl7zFCFwB4psweImjVPLRqAu1ZeXPra9Ts341nFZGK4L+GUHCX1ky3IuiB 1tDrGkF/s38/T4Uf4qf41QeVXZmrytXgrDgbVUu+K5/Fd+d78P35fL5A7iynyRlyVzlL7i73 kHvKveW+cp48QB4oF8qD5SHyMPlrebQ8W14oL5aXyqvkNfI6eaO8Wd4q/yjvlvfJB+XD8k/y MfmkfFr+RT4nX5AvyVfka/IN+ZZ8R74nP5DL5cfyM/mF/Ep+I7/TYZ1aR3QGOkEn6XS6yjoj XRWdia6aroaupq6WzlJXV+ekc9W56zx13v+7tvp/11b/296mqsRUUSpvovNleqroL707wvAC p2uuVVjpT5WVcJ/W0f0f1sJ9WkXHrsE15uIrzCMqe1oxnPw0G4cfo2ds7OvCubMz/Ni+UK4N F8W152K5ZIao2QybdyjPrr+UlOfVFRO7yufJ/fdJebpdMSnPwr+Y/H6TApUn5Z+l0N8n5al5 xcTq8geJsdZnidX589T+S4mx3GeJeenzFA/p1+3k36TOLKX/Qcr+UmKM+nmK+k3q+JvU5fP0 oX5wt++v8L+zj38w+4jROcby3kyRKN/ZFAnf//Tb736awMa6pWg+WspGuxvQNrSLjXePopPM f3pY0/F/m7v/S3nov5J/cY7x/QykyEwpXsjO8VPGUYzrqsLIqzq8R26DlVFlGB7PyhPwRFae hKey8jS8mpXX4PvKN2jjh0iFy+E3hJ7gp6z8DL8AznzFyq/xW1Z+xym/5sRxatbmeE7DyoRT vnVa4ERWluC3kSpxlVnZkDNm5SpcVVY2gd89qs7VYGUzzpKVa3NWrFxH+RUlxrE2rNyAa8DK tpwtK9txdkj5daiGrNyIU37D7DvuO1aewk1h5ancVFaeplJ+QbAFY2aVKog3YaNURcVwTAmF Kt9Qz7dh4/RwPoOVM/kerJzL92PlPL6AlQv50axczBez8hj4bfV9/D5W3k9FhJkCUuajqrLR MaYm1IGVHQ1WIGyw0mAlUhmskpivpAfSA6SSHsoEYZnKAlLJItPWWE5mmkOla8w0IGYj5eaI 07XQdUb4w3fLKHie+OGN/V/1CAY9gkGP4ApvjWPQIxj0CAY9gkGPYNAjGPQIBj2CQY9g0CMY 9AgGPYJBj7y/Qw5UCQZVgkGVYFAlGFQJBlWCQZVgUCUYVAkGVYJBlWBQJRhUCQZVgkGVYFAl GFQJBlWCQZVgUCUYVAkGVYJBlWBQJRhUCQZVgkGVYFAlGFQJBlWCQZVgUCUYVAkGVYJBlWBQ JRhUCQZVgkGVYFAlGFQJBlWCQZVgUCUYVAkGVYJBlWBQJRhUCQZVgkGVYFAlGFQJBlWCQZVg UCUYVAkGVYJBlWBQJRhUCQZVgkGVYFAlGFQJBlWCQZVgUCUYVAkGVYJBlWBQJRhUCQZVgkGV YFAlGFQJBlXy8RuKPn1fUY0ezBrDXlQjQ19Yo7PGoMGQFkOeSZhwMwprtGO7IjmMHQS9gYa3 lVVcdR7pO2m0thqsxoVuHFbPiNC30dtV2GNWaj7QDB7eeqNQlIh6oCwGqCkol/1XHub66C0r XExtfHa4dvlz4++HuFX7eXjmpQ6qlNaBN2YUVm2gL1Qb6gu5lzNUHOYYUGxHI7y9h1U+4vM0 6c75pnrp051iNbunbAdbvY1G1VYtGNX2y8r+Kietc5dcC+skGwsHDw83i9ZpSTlZPbJScy38 snKyGzmY683en1zl8yNZOZ1y07K6OVjqaynHVUamvx4Pz8rKtfDtmdslKyct9yu9uYnk4aZ3 cNDr3fTsX4yJ5Kh3cHRy+LD5D9xRIa5d0S2YR6pC1uzYfi1XiDFawG3enn3NqzykhvX0iX3i 9bdKF4yq2/H52/HBs9a9nVpq4ZPXpvS70uIEx4wjzZK/ure4157I0+W3pwwxK54+OHXVjxl9 E62O1/Q+p8Njb0zYubVhaklJl3qTD3vabRXXtKu3PfC61sd9gt0Ca4/5d1oOanZ5sG5jSWbb TosL82YmNOwdfHPy6mSvkjAzB1rHePqC69/Yml5rPCnJOKEdnzK9plv40Gfz7o/jdtX4aWvb gFXDB271vBM5LmTpm3l9u+aGLDPdP8HA2hJFj0lIc9vYypB4R73r8Gp2qpbOPVoQFX1/rVd8 1YLe6tNPtywdOP7t8gP5x+dVz4n13rvpAZ1VW79KU7RnlUVvo6LznIo1/FkF8/UFc/QFpcyb NbG6oERfMHFgpQ6Hs++n5UyzajPAeGXr0e/2zcz5z8ev8E/auEqJ4fgbwrZRjyaautxdj+uc 7F35UWyC4/Rpwj4f/pthxXs8r1mWP4j+1m7NjOZlifdfn9jv5RWzwDUy7W2drk327F94js87 6zCq8fRK2ekb3xqGmqZte33Y73LlGIvQW4n9li2sVmbrVrfhlpSZhl/X1SXNehZp9sJyz/Eq j8IXd/NzJG8KTZ5f7ZwptXm6+WH47s3Xd+pfWzgYDKs53qZ662M1uTkPB15Qre7weMXZsuh7 KS13h0euXa2yNnw35vgDWjxg/cQfF7nZXel7ZX7vy71moMPpTbYfdf36gq/hfJf0GulnXC7+ bKa+Mj9AXRbj5N6ttZmUuE5bOvKnY5FNAg+YtZ2bfcbQc+i3PafPOzqDoUKCvlAV/B4VtI0W Vf4l7F3s1H3bPmJKzX8KDFi/d3dk/xgCODIwcHBkmy4fweArQFB2EY0R1zbCwUhfWdmgRtro Tj26pHXrnMv+TCW9rOwkRiQ8JblrVrfkjzem/aMbs9Jbvr+x6hWPJ6dYRKR17sauahHm5/un qLDuq/7H41YFeMx3Xuxw+kVdl5a9t72qNW13QPf7RwJv/DxyR0ZweOLjydyO1idbZtrX8UnZ etBqndBiXX7PswGbFxbLYT/WtS2fcV2yqnXEt87LxMmHqgXM+Tao1uQDq+xr7whqmJd1qoq5 10iPSh5nN9s8TvVqiB3fva3fYu6aTDx0yqsNK5PyC1/EzigYXDR6efn6cbMOuc8NKzKpPzTk rP4pavx414vGBVuG3M30mNfI+enqRsu0/RO/6ZM6ZVIPaciy8p2PLL4PNRyVtM/ulGNAtXsb gyZ4hUWYHkxt89XCJUPLonymF4YN68avcNner87m8NTGk0P22w5w6ja4uebItMNBQ7huQ9Ds bUPPR3xAhZf6gmd6IwUU6qpFvVZDGaHxPFGp/mdAhU65RyPlh3N5vYoZfU1lh6yuqjbeX/Ng L5TdYdnD0ztDStr4N5rln/RALyiHdWo160ZDKnQdwJh+i5YOCKpXfnBTSG5pu/q5DXquGvJm UfC4Pqj1zb23TX9J+1EuzXvE+e3aO3T/84j9P0zfHJX1IMl/gT+6N6Gs5JjZemF6NWncidPm S2z63787t8fi4nMeoxtPSt/k3vXosGVWb87fPJ5m8M2wzW8voo3Oj57lvahk2Ii/bTPh22YZ 1t3XuRdfINKeuC4HNg/0zUidv3HdxtHOe8tVlfL6Pjl6odn5fm8vXlz89un5Y9Kq7ONjL4eu dS/Na/hz4zPOQqIbN70g3Wr409ik4uUxGz1OJIxsO7i60xOvSTMKxdKOI1bZrZs5Z9+i0xZr t+qrFVkYSw02hT/2vRCvvzzWOm3o9uxLj+YtOjiwWU4vmWFMOsOY8A8Y00nXpzUoJFXFfsQz nPkHe/VHwHHS6xniODHA0XvoHZVNJ2VTn/u33NqH46o/OP6nWFN6Rjvq0A/bW353YKGn8xKr 9hlnMrdY1l43ruzW0q27jtX7wbHyiE2n4+xeuUaZV7FdWiydNZ7VzTo4v2oT38Wjmq4IHCad Khi3ZKLmcLR/r9hbD1/Ll/JzZznty716/3KnmQNU6wLeHfMxPLZ8b7x0uF/5OiPpdUK6dVHP keuWbCq6YbJ6zJYnVdcmxt2tfN7znmWHEcsG9tgRcHn88N4J311f0nu72ygnY3ujM4l7llZf EDqp85KfLTz03S+M6hx4aZfZYyks19f+Bl8n3TKj5fKxO1d67G42p2usadCi4hOjB/n00TY/ OXvlYKsdl8r7pa4Iyt1cz7fVlE7GCSH6ssJHh4XsvHttW/c+Stv2KviANc/1BU/A9zV1So9l nVCzrUKHfWTZdHRem+eRrSZdNTmRPsiZb1TvxpehScGJmlZqU33VgV/u5v7KCbXUjfVeeo8Z bjNchjh1yc3N9rS3T8rJbNT1YwwbJWV1tc/OSFP22mfnZCX3TMrtYe8XwRpaI7ZL3+Ljn2Q6 xFvvqXf/uK3nhth9uGDv3r2/dMGUnApXyv1NBwK0aRqdFdF5msUgZyxfM2nlveT2yYL8e9JX ub1DJzY3fYSqpA04kzim9E3nmVOuWNu8bHti8tuwrfEGq76fe7fw0STzrPYvnzy8KP40gvpU NbE4sm1NQHNaLyHaoNW4B3T/htbdHlxqYWjtMsIy53zHtcvSDOuMu3fT2eDMgG5ZY7XhexsE t1zoaDfkxsz9cfU2bfK+0GHlIGGDi1no4IDm7zaOm9meLJhwts/m6Pw580L2ly+ZUuJ7aV9s HZ9f8p2bhzw9VNZv6u21e6YkGUcsW1Jy/8TWQzNmLhq/t6/tULttu0+9zlSd3uq+5OGR2Gom um3P9g6cW4lWPzvG6vrymcE+t5ZXrtdH3m73/eyM3cXeDG2mMrQp+og2LfPuAtrw/xzaRKZ1 TemR26lrdkW0cdV7OLjqHVxcHEHeOMCmo17Z1BfM/Vvurb6+7nuiNO/ml5bdJSXHwj8iwCIg IsTTQe/v3tDF3dmtoV+zQPePJ6qMzP+gEhEpOb3SklL+FKBubeCTyk59tXSwv8+cVTvvBk+r c96jl7nBccegdn2O2p6aQ8bcv9741eZ6ebNeXe0/wPHQqcYjPNzKn5/0cq7689jCV853uhTl VC++sD74wvqiR05abntprx4uwXEP110M6l9z/bg+Z96ZF1VpFtj9YH79aMMjg0K9Dr0893TE 3Sbo8rFznV6YjGo1u8D7SVrTWxeHbyWhG3L73RSvNr+1KPPhsc4F9HnVvf2NNva4ZBD8MvHV 3RkeJZ5vb1cu62Se2O6kNnLQMa9WrS613WyfUH30WN7vdNztQq3VRIMZvEPKiG9DzH0tS8eO eRPgH5DlsiLAbUnagpQXzn4rTH7w8rhYaWR59aGXI8NqeU11WFIRoH4FpAE5Dxo1ibK5UPdZ l/X4dauLAw5d9vkMe7JuhDSZ+L3zolZDijdNubXYy9dv1+H/Fvbk9shO6vRvwZ6PV8r9EoLS 36HwFwAqrW+hgVj1yLlDgcMbbT3i3Lcgv761b4NHP1mOlScu6RgRb/Pi7vbIoPn9nxkdFoxf tC4fUgV1uzyopnXAPDsPx7NZJW4x96zCiyNVo5rMm5Ls/tS1zNhvrafPpD3Sju4F1o9S5zlc io0rfhEefjH29rdjpqYZBA8/cqRXsLOUfjHPf55th0GR+QF1qtXd+XXgj3UvVxuYZmP81GTX g9p2BYHxto9fzN3V28cq68Xc5KLRpYnSgobm86+O8cl/t3z064l3Hr5RLzvQ8mBM7uKXj4xq 1fA4OGv18U2PV98rW1IeZf7K+2HZ8Qb+m7ZOadI/1fTASosk7d6mjVMcq+WtXN94e70WIbWr Te42Ur/94TefA1SldGFy6DZUd1HlMwG12vXtXPpbmPpnBl8f0Env7OymoJMH2/wHBl+/A84/ w5tf3Lq9WlbWLKi7adnBFj4R214uMt5g57jRMDS8bNBdH6dTLR3GWq/9JvlCrbDBG35odSSf f36/55YRu+cfW5qWndqnfuqNtevuF31/4N7CN4azhfa1bewPNT0Vpa7Ra03X5K5BkWfOPjy3 dfqg3QPP5wdzbuOebJtGo8y7ND9waluvWPv+a+uqV0d1SDdLejcwz/veMXXd1h69c0ncD7En h7jZ9dwj3zL3MMjr9XZqZre+F+74FE+c1l3u2CDUNDHBcdrRQSG2tWO7BIw4Zz+4UtjKF2uq j8q8V/c7o+f7Kp0okh8X9urhumt839L9CZo7/PIhTuuej+sw2Hdwu6Jx3ZbXsmuxP2uK34X0 G/n1Rme8x5tCbM08UufLPfR/xPCrksbgwwRoFayMqVAF9PwiOFb79AFjTi2aa1EE6okSkR/y /Xxo9rtx3RcAalzryg4/5IVtrDx6ZieC5ZHZAaPu94jc3MSAb/hufZuIIrO7Ht+smxUlnBu5 1qvGkVeL5+1Zt6KNZY0smjYgQ1VaO/Bu5uquebXXB/40+NEo3Rbytev22wNuZscFTB97dP/B s6O3Xdza4EDenT1LHY8N/X5f0k7XI6aWW3ud8ypZVaPHNMv/WseNLVuEQnq+zDmU6jVLQ21O Qhe/9XHh1AqP3efXNlv5b0iKuGfw8qWl7OPOT7csG38KK/akNCSzsUz7NIvJWb/arWPXf6ab qT+97t1iLpm8mTWP58zcOxqJNR4fxecIKlowybSvYTs6zWjHU4djwbZ7V3bee5Fm3vtFadqc MxvKQwKtrhW5bFL+ZtjEsh5YSK1mYmQ0aGwfwF4ZSl8RMca9oPGWgQg8vjUYDdmZWcH7BECp ABqZnMyGPMjD6kDXIHjchnwGyLKiBsoIjSyGwDT2aH1n6bL7lpOX9R9YEfU+S/Bzl6esQQqS Fh7DMIOQBVoNGgy+DJkMyQxFDPngkfk0hhIGBYYQhkqGAiAvHSieCGRlMFQuVGtQwVm9llQW 5KcXJRZkVCqgFW8sTYwMzdaBrad19s4/2P16gdMinzvab64rbWswCdy/JmLrsilrLVzn+1TJ PHi+KuWXuWhi2r/s/oyAFX5FG3mnvCj92u8578vz9RGxTy4JbBXR3WR/5cUvhomvyx445FpH bkmNCO2cZckh0qbjcbLJ7Pej3SIHcusZuR3VNv0McFhiYx0oXbEgvjbmnWvlqgsfBOv4Et7O bvdoadPxY4s+EmD2Ovz7CjeFzZ+2lNazP9Vw+KGb13bYYdnKsIbG2FvzlzBqfJS8cnla+LzN ZQkGD8PqI6Q7XBgubNZV2VoUvESmpeZnrtYTZmaBrhlKy+4KH99/aoZf9/VpIh8F3/7l9U/m 26F159JjEeb5r8tD3ixf2MQkb9DEJI2IIzbDJiYeoBAH3ZMoeo2E0sFghybRBbEGEsgpkRsx C8QItBMuw2rID6xqLQwNjIAVrZGlCbBuRU+IfZ93Ok6Sib1c//HuqWf6s56Zqs75jFZmgZLI haxM/oxLL46rRxSHPDVy8797dNpONQ2jmU0XtpbsK/EP07mx+Jn5r8c/21/HlR64dDV5Z5a7 kuOZniXsXxb1BrsfLJeZppKrx6jId+rNrWz30J/vp966d6TW4tOOIG6uT0bsRvWf1ZMTmivu /vk5bbv2FUemKk3NrWfky8RVOmdIda/siHqwTO+Kg4PbP/ULAuECrYs3cZZ0BvWYPZJ7yPT5 xflMB7GzSmEbVkmsOsEv9SqtUKLNpfvII9Pt6SxajuHz3BesCGlim39nxsml1eVvUhX/eR38 Im5rstbPZs/mHU8ig76laolGMrg8X60cUCqlHLmVx+bdi5Kfj5c5VbQu0nl9Z09Q15NrG3gZ AFd1IXQNCmVuZHN0cmVhbQ0KZW5kb2JqDQo4NSAwIG9iag0KPDwvRmlsdGVyL0ZsYXRlRGVj b2RlL0xlbmd0aCAyMjc+Pg0Kc3RyZWFtDQp4nF2QTWrEMAyF9z6FltPF4GSm0E0IlCmFLPpD 0x7AsZWMoZGN4ixy+8pumEIFNsjvfeJZ+tI9deQT6HcOtscEoyfHuISVLcKAkydVV+C8TXtX bjubqLTA/bYknDsag2oa0B8iLok3ODy6MOCd0m/skD1NcPi69NL3a4zfOCMlqFTbgsNRBr2Y +GpmBF2wY+dE92k7CvPn+Nwiwqn09W8YGxwu0VhkQxOqppJqoXmWahWS+6fv1DDaq2Fxnx/u xX2q6nNx7++Zy9+7hbIrs+QpOyhBcgRPeFtTDDFT+fwAB69vJg0KZW5kc3RyZWFtDQplbmRv YmoNCjg2IDAgb2JqDQo8PC9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDkyNDgwL0xlbmd0 aDEgMTk1MzA0Pj4NCnN0cmVhbQ0KeJzsewd8VMX69sw525Ldze4mu2mbZDfZZAMkJJBQQs1C Cr2kLCTUhFBVWugIiF2D2MCCFXsJymYRCWJBxd69tqvXdvWqV0WxXkWSfM+cdwcCev3wd7/v 73d/XyZ5zvPMO+XMvGdmzruwYZwx5sJFxyaWVo0a8cuq7zOZ8n4dY+4LyoaXVm/Te29m7MO3 GIvPKRs+tuTVedO/Z+ztiYwZLxhRWlb+6ePfHWHKO0sYU78aMXFC1YLZg85i7Ccd49dZRlQF hz/x3kcdTNlqZ2zEjAlV+QU/f/zWF4xx9MfqGhbWLznQ7+ufGOs2HwPo1rByuTd07YFXGat9 kDF9ytwl8xb++OM4C2O5lzIWlTyvftkSlsJ8uH8A7e3zTlszt0/zQgdjM9Bf2c3z59TP/iSr fQj6n4byfvNhsN5j7I/8VuQz5y9cvprPTHqOMaWIMX+vU+c0Lnro5SfOZeyxA+h/+GmLG+qr lbKHGLt1HWNp5QvrVy9J752FsfNWtPcuql84x7+yAvN/3sRYTPySxcuWd7jZeRiPV5QvaZyz 5NSdSjtjfXfgdnYmfKu/oXXC580zZtoG/8CS0Axp3xfrnhf8RMbVa3853LYp6kvj/chGMYVR QjsDa2f8QPT2Xw4f3h71pdZTp6T+KCy2DHYu07NRTEVLO8tncxhzXKrdlzNVl8MvRalJv01f iC7TiNWX2XkKMzHFplcURacqug+Z0hFgOzq0ESCNq/J6GfzrjaMxGG9Q/F7Gb9Tuu0cfI2aK 3mOOjYa/hKd3k3gufyzpprAdulJW/5tlX7Idx834s+Pz/y6p9/x2Pd2RY3ZFd3J9aXU3M+PJ 1DO8yXboe/x2v/qxrOFk7yeSLuNYP7qaE/xwDxvxW23UT5jtuHtmsLtP+n5NLMOYxob8yp7N ep1sH13p/8+kvs6m/dE2uj5smzqLTTnJunXH3e8XNv1k2ilLWdYfHdf/ZFIPsL4nU0/4Smr+ Bs77P5D45x2vH73fLcf1s+236htms22d7/ersRSd3DM7Wj/Sl3iGyrPH96ums4qT6UO5l6X/ kXv+Jwnj3HqyddXrWYa+9befoXojy/g/N6qu1JW6UlfqSv+NSbmWR59sXd7BeiiZbCSwT9Gz q/5vjksmZRkrE6we6fjxf+J+J5PUvmyTfsWxvDH7zxvLf5rwOfnUCFf+yeMYCdwLNEbyvYA5 YnxAw589vq7UlbpSV+pKXakrdaWu1JW6UlfqSl2pK3WlrtSVulJX6kr/tUmNIIW+zcZzkYNS E5mO22HwMy/TMQOUlWUgl8cKWBEbxMrZaDaR1bBVbA3bzu7x2r1xHR1aj1a08LNc1ov1YQNZ gI1k41glqz+uHu/4AfdoBB5UH+w8HD6+o0F54qNZH9VHvl0n/s8+U1OZ6LWA9WOD0eNxM1BH q1epQbVRrVEnq5PUazFeB4tliZiTGEc+RlHKytgYNplNYTPYbDafLWPL2RqucBu382Sexrvx iXwKn84X8NP4Yr6Cr+Tr+YV8E7+IX8qv4bv5fv4oM/Avtft9c+L3/pBXIt8SVNjvJ35sxJHB X91pItocwF+qB9WvwIfUb9Rv1e/U76Exs6P1jp8hi8xRJDlPdvxMfzWMPzZzxp/638zrz09q J7n8P+6ta+0ftwICI2bPnDF92tQptTXB6qrKiokTxo8bO2b0qJEjystKS4YPCxQPHTJ40MAB Rf379c3P65nbzZ+V6cvwJDoddpvVHB1lMhr0OlXhLLfMV17nDfnrQjq/b+TIniLvq4ehvpOh LuSFqfz4OiFvnVbNe3zNAGrOPaFmgGoGjtbkdu9gNrhnrrfM5w29UOrztvIpFTXQm0t9td7Q QU2P07TOr2WsyKSno4W3LHF+qTfE67xlofKV85vK6krRX4s5usRXMie6Zy5riTZDmqFC3XxL Wni3oVwTSreygS0KM1nFbUNqVln97NDEipqyUnd6eq1mYyVaXyFDScio9eVdIMbMNnlbcvc3 XdRqZ7PqciyzfbPrp9WE1Ho0alLLmprODzlyQt19paHuaz9OxJTnhHJ9pWWhHB86G1N59AY8 pM+y+7xNPzAM3nfwy+Mt9RGLIcv+AxNSTPGom1AuNcPYMELMLz1djGVTa4DNQia0saKG8l42 yx1mgfyc2pBSJ0r2yxJXUJRslCVHm9f50sWjKquL/K6cnxjaOMvbMxfe136z8Ityb0j1181q mC+4fk6Tr7SU/FZdEwqUQgTqI3Mta+mVj/r1dZjEAuGGippQvm9JyOkbThVg8IpnsKCqRmsS aRZyloRYXUOkVSi/rFSMy1vWVFdKAxR9+Spq9rLCjg9a+njduwqxr2vFOELxJXgo/rKmmtlz Q54692ysz7neGnd6KFAL99X6aubUiqfks4e6f4DbpWt31FphbifUlpXFzI1ZJm+N4lZrxdOC wVuOi2/4YBTY8bi0rHiiwwd7a7ibyWq4S6SGUMf1g4yaVTJSFKmiaclId3ptOqXfGZI7MiZ9 VsjUqS87DEfHRPf5t0Oj2mJA3b1lc0o7DfC4TvWRAUZ6++1xKsIXkRujhUk8zpGySM3CzoVN QTeaSTzFRG+ITfTW+Ob4an1YQ4GJNWJuwtfa8x1T5RtTMaVGe9qRVVJ9XI7KiygXYukolhml BGuwPMctH6uWH6Hlj2ZHnlA8ShZ7m0y+MVVNonNfpEPmxQ7CpA3+UfWbimL7YGuW43Tzldf7 8NIob6pv7dg4q6klEGhaUlY3f6DowzdqdpOvqmawWxtrZc1691pxq1g2ho+pHt4zF2fP8BYf v6CiJcAvqJpSsxcvNO8F1TVhhSsldcNrWzJRVrPXy1hAsyrCKowi4xUZ0VMlMiatvntvgLGN WqlOM2j5hlbONJtJ2jhraFXIZpc2BTYd2QKaTSQ8pMT5cDGO2zLvbPF41tXOb6qrFZuLxeNR 4peHuG8oCym+oS1cMVhC0b45w0Nm33BhLxb2YrIbhN2IhcHjOZwjzqSmOh/OKSyoGubmtBRV 0aW3taOjuib9BffB2nQstWnAlJpQVA7Ofn3WaNQbIVAH84jQxoZ6MQ4WrBFtjVmjGmqxbGWH qDIqFIUeoiI9oEa51kYsRzRqwLPBA9Tab0QmtLE2VJsjblqzoFZbzvYQG+kbiMdOfer94kb5 tU2xvgJtb2IrRGedLygKY2NVNWRxI4ub1ZKTjBaMvMGHooY6L7ytYw1VWOp0lka7yTIHR6LO P0dDtDtSyMS01CyzNToUlYcO8Su0OU9sSX2WsbaWBq/lzo9UwL3tITNG5O/kykgDeAdFo8RY 8Hs+hiqqPiq6qWhllb7VOFnEoLWejCgOWbNG1ePwp/ZmWHxFsrFJnBHmSB8HyGoUM7fA72pW dWvHHb416Z1Sz1yfeDmIhcnce7GwWW3TiYbQ1JyeuaYTrVbN3NRksv52A/KXyXqUhdFbhrcG Y+Eo1duqnHNfVCIfDXG2FGdJcaYUG6U4Q4oNUqyXYp0Up0uxVoo1UqyWYpUUK6VYIcVyKZZJ sVSKJVIslmKRFAulOE2KU6U4RYoFUsyXYp4Uc6WYI8VsKRqkmCVFvRR1UsyUYoYU06WYJsVU KaZIUStFjRSTpZgkRVCKaimqpKiUokKKiVJMkGK8FOOkGCvFGClGSzFKipFSjJCiXIoyKUql KJFiuBTDpAhIUSzFUCmGSDFYikFSDJRigBRFUvSXop8UfaXoI0WhFAVS9JailxT5UuRJ0VOK XClypOghRXcpukmRLYVfiiwpMqXwSZEhRboUXik8UqRJkSpFihRuKZKlSJIiUYoEKeKlcEnh lCJOilgpHFLYpbBJESOFVQqLFGYpoqWIksIkhVEKgxR6KXRSqFIoUnApWETwDinapWiT4ogU v0hxWIqfpfhJin9J8aMUP0jxvRTfSfGtFN9IcUiKr6X4SoqDUnwpxRdSfC7FP6X4TIpPpfhE in9I8bEUH0nxdyk+lOIDKd6X4j0p3pXib1K8I8XbUvxVirekeFOKN6R4XYrXpPiLFK9K8YoU L0vxkhQvSvGCFM9L8ZwUz0rxjBRPS/GUFE9K8YQUB6R4XIrHpHhUiv1SPCLFw1I8JMWDUuyT 4gEp9krRKsUeKe6XYrcU90mxS4qwFC1ShKTYKcW9UtwjxQ4pmqW4W4q7pLhTijukuF2K26S4 VYpbpLhZipuk2C7FjVLcIMX1UlwnxbVSXCPFNimuluIqKa6U4goptkqxRYrLpbhMikuluESK i6XYLMVFUmySokmKC6W4QIrzpThPinOlkGEPl2EPl2EPl2EPl2EPl2EPl2EPl2EPl2EPl2EP l2EPl2EPl2EPl2EPl2EPl2EPl2EPl2EPb5RCxj9cxj9cxj9cxj9cxj9cxj9cxj9cxj9cxj9c xj9cxj9cxj9cxj9cxj9cxj9cxj9cxj9cxj9cxj9cxj9cxj9cxj9cxj9cxj9cxj9cxj9cxj9c xj9cxj9cxj9cxj9cxj9chj1chj1chj1cRjtcRjtcRjtcRjtcRjtcRjtcRjtcRjtcRju8ZJcQ iJrDaUM9iJnDaS7QWZQ7M5w2ELSRcmcQbQinWUDrKbeO6HSitURrwqnDQKvDqSWgVUQriVZQ 2XLKLSNqJOPScOpw0BKixUSLqMpCotOITg2nlIFOIVpANJ9oHtHccEopaA7lZhM1EM0iqieq I5pJNIPaTafcNKKpRFOIaolqiCYTTSIKElUTVRFVElUQTSSaQDSeaBzRWKIxRKPD7lGgUUQj w+7RoBFE5WH3GFBZ2D0WVEpUQjScyoZRuwBRMbUbSjSEaDDVHEQ0kJoPICoi6k/Uj6gvddaH qJB6KSDqTdSLOssnyqN2PYlyiXKIehB1J+pGlE1d+4myqM9MIh9RBnWdTuSldh6iNKJUohQi N1FyOHk8KIkoMZw8AZRAFE9GF5GTjHFEsUQOKrMT2cgYQ2QlslCZmSiaKIrKTERGIkM4aSJI H06qAOmIVDIqlONETCPeQdSuVeFtlDtC9AvRYSr7mXI/Ef2L6EeiH8KJ1aDvw4lVoO8o9y3R N0SHqOxryn1FdJDoSyr7guhzMv6T6DOiT4k+oSr/oNzHlPuIcn8n+pDoAyp7n+g9Mr5L9Dei d4jepip/pdxbRG+GEyaD3ggnTAK9TvQaGf9C9CrRK0QvU5WXiF4k4wtEzxM9R/QsVXmG6Gky PkX0JNETRAeIHqeaj1HuUaL9RI9Q2cNED5HxQaJ9RA8Q7SVqpZp7KHc/0W6i+4h2heOLQeFw /FRQC1GIaCfRvUT3EO0gaia6OxyP85rfRb3cSXQHld1OdBvRrUS3EN1MdBPRdqIbqbMbqJfr ia6jsmuJriHaRnQ1NbiKclcSXUG0lcq2UC+XE11GZZcSXUJ0MdFmoouo5ibKNRFdSHQB0flE 54Vd9aBzw65ZoHOIzg675oLOIjoz7AqCNoZdOIz5GWFXP9AGovXUfB21O51obdg1G7SGmq8m WkW0kmgF0XKiZdR1IzVfSrQk7GoALabOFlHNhUSnEZ1KdArRAmo3n2gejWwuNZ9DNJtqNhDN IqonqiOaSTSDJj2dRjaNaCpNegp1XUs3qiGaTMOdRDcKUi/VRFVElUQVYWcANDHsFHeYEHaK 5T0+7DwbNC7s7AkaS1XGEI0OOxEX8FGUG0k0gozlYecGUFnYeT6oNOw8A1QSdm4EDQ/HloOG EQWIiomGhmPxfudDKDc47KgFDSIaGHaIpTGAqCjsGAHqH3bUgPqFHVNAfamsD1Fh2JELKqCa vcMOMbFeYYfYm/lEedS8J90hlyiHOutB1J0660aUTeQnygo7hJcyiXzUZwb1mU6deakXD1Ea tUslSiFyEyUTJYXt00GJYfsMUELYPhMUT+QichLFEcVSAwc1sJPRRhRDZCWyUE0z1YwmYxSR ichIZKCaeqqpI6NKpBBxIhbosM3yCLTbGjxtttmeI9C/AIeBn2H7CbZ/AT8CPwDfw/4d8C3K vkH+EPA18BVwEPYvgS9Q9jny/wQ+Az4FPomZ5/lHzHzPx8BHwN+BD2H7APw+8B7wLvJ/A78D vA38FXjLeqrnTWtvzxvg162neV6z+j1/AV6FfsWa43kZeAl4EeUvwPa8daHnOehnoZ+Bftp6 iucp6wLPk9b5nies8zwH0PZx9PcY8CgQ6NiP6yPAw8BDlqWeBy2Nnn2WZZ4HLMs9e4FWYA/s 9wO7UXYfynbBFgZagBCw07zGc695rece8zrPDvN6T7N5g+du4C7gTuAO4HbgNnNPz63gW4Cb 0eYm8HbzqZ4boW+Avh64Dvpa9HUN+tqGvq6G7SrgSuAKYCuwBbgc7S5Df5dGj/dcEj3Bc3H0 PM/m6Ns8F0Xf4TlXzfKcoxZ5zuZFnrOCG4NnNm8MnhFcH9zQvD5oXs/N693rx6w/fX3z+nfW B2IN0euCa4OnN68NrgmuCq5uXhV8QDmPzVXODQwOrmxeEdStcK5YvkL9fgVvXsFLV/BeK7jC VthXeFeoluXBxuCy5sYga5zYuLEx1KgbFGr8oFFhjTy6tWP/rkZ3Wjk4sK7Rai9fGlwcXNK8 OLho7sLgKRjggqJ5wfnN84Jzi2YH5zTPDjYUzQrWF9UFZxZND85onh6cVjQlOLV5SrC2qCY4 GfUnFVUHg83VwaqiimBlc0VwQtH44HjYxxWNCY5tHhMcXTQyOKp5ZHBEUXmwDJNnKfYUb4pq FwMYn4KRMDcf3ssdcH/gPuTWMXfIvd+txtqSPclKd1sSL5mQxBcnnZF0SZJqS3wpUQkkds8t tyW8lPB+wtcJurhAQve8chZvj/fGqy4xt/hx1eUaF5cS9+6rzXVcvM9fbnNxm8vjUso8Ls4c HzgOOVTXI/aX7IrNxm22DpsSsKG6LcYTo4hLR4waiOndv9xm9VgVcemwqvEBKyyix2zLxOpy m9ljVoLF5glmJWAuLikPmHv2Kmcq93LOuB2kmsQouMtTjn29K57rOd7nLdVVOTljWk2sckzI NHFqiF8QyqoS10DFlJDhghALTpla08L5xbUtXCmpDjnF/9hq+XM3b2bDU8eEUqtqQttTa8eE NkIEhOiAYKkt8Wx4bc6MZSuW5eQsn4HLjGXLc7Rf5PgKkcsRRvG7bDny4meFlmc5v5uoGmjm MqTl0rj891v9v574nz2A//7UwsSXDIZ1KOew2crZwFnAmcBG4AxgA7AeWAecDqwF1gCrgVXA SmAFsBxYBiwFlgCLgUXAQuA04FTgFGABMB+YB8wF5gCzgQZgFlAP1AEzgRnAdGAaMBWYAtQC NcBkYBIQBKqBKqASqAAmAhOA8cA4YCwwBhgNjAJGAiOAcqAMKAVKgOHAMCAAFANDgSHAYGAQ MBAYABQB/YF+QF+gD1AIFAC9gV5APpAH9ARygRygB9Ad6AZkA34gC8gEfEAGkA54AQ+QBqQC KYAbSAaSgEQgAYgHXIATiANiAQdgB2xADGAFLIAZiAaiABNgBAyAHtAN68BVBRSAA4zN5rDx dqANOAL8AhwGfgZ+Av4F/Aj8AHwPfAd8C3wDHAK+Br4CDgJfAl8AnwP/BD4DPgU+Af4BfAx8 BPwd+BD4AHgfeA94F/gb8A7wNvBX4C3gTeAN4HXgNeAvwKvAK8DLwEvAi8ALwPPAc8CzwDPA 08BTwJPAE8AB4HHgMeBRYD/wCPAw8BDwILAPeADYC7QCe4D7gd3AfcAuIAy0ACFgJ3AvcA+w A2gG7gbuAu4E7gBuB24DbgVuAW4GbgK2AzcCNwDXA9cB1wLXANuAq4GrgCuBK4CtwBbgcuAy 4FLgEuBiYDNwEbAJaAIuBC4AzgfOA85ls4dt5Nj/HPufY/9z7H+O/c+x/zn2P8f+59j/HPuf Y/9z7H+O/c+x/zn2P8f+59j/HPufNwI4AzjOAI4zgOMM4DgDOM4AjjOA4wzgOAM4zgCOM4Dj DOA4AzjOAI4zgOMM4DgDOM4AjjOA4wzgOAM4zgCOM4DjDOA4AzjOAI4zgOMM4DgDOM4AjjOA 4wzg2P8c+59j/3PsfY69z7H3OfY+x97n2Psce59j73PsfY69/2efw//lqfbPHsB/eUqcOYMx 4w2MtW857nvaE9kpbBnbiJ/z2Ga2hT3C3mGz2NlQ29h2dju7i4XYo+wZ9uZ/9rX141P7Gv1C ZlH3MAOLY6zjcMfB9tuBVn1MJ8sW5OJ03mOWDnvHVyfYvmrf0mFvbzXEsmitrVV5FdbveFvH Ybxfke/oJ/LK+dA2rcU3xhvad7bfcYIPKtgUNpVNY9NZHavH/MW30RfAM6ey09hCtkjLLULZ PFznIjcTtXCWaPpYrcVsCdDIlrMVbCV+lkAvi+RE2VItv4Ktws9qtoatZaezdWx95LpKs6xD yVotvxrYwM7AkzmTnaUpyWQ5m53DzsVTO59dwC783dyFR1UT28QuwnO+mF3yb/Xm43KX4ucy djnWw1Z2BbuSXY11cS277gTrVZr9GnYDuxFrRpRdAcuNmhKlD7In2W52L9vJ7td82QCvkUek X+ZqPlwCH6zDDM/uNGLy36qj3tqAuYu5NUVmuhr2szq1WBnxo6h5NmpSL/QcRC/rT/DEpZgD 6WMzotwV2vyPWTt75fes0h/XdfLMtVpOqBOt/05fya7HDrwJV+FVoW6GJnWjpjvbbzhad7uW v4Xdym7Ds7hDU5LJcjv0HexO7O27WTPbgZ9jurMivpfdoz25EGthYbaL3YcneT/bw1o1+++V /ZZ9V8QePmrZyx5g+7BCHmb7cdI8hh9peQi2RyLWA5qN8o+xx5EXtSj3JHsKJ9Sz7Dn2PHuJ PYHci9r1aeReZq+yv7A3uRXqFfZPXNvYy/qPWQwbxpj+Afj5OjYDP3qcSsvUV3GKqMzIBrBx bDyb+iCz4nUfzwby3btdpaWmnsaH8SpXmBfBgIlxXhKw6RTrnuTkYt+evobNqmNUK+95X7Fx M8Lc4rb32l7Mb3vvYOyA/IM8/90P3/vQ/s2LjgH5hR++9mHvXtyR7tDgjFGMRqfBl5Gn9M32 9yssLBiq9O3j92XEKJqtT7/+Q9XCgjRFdUrLUEXkufrqkSnqhDaDssFXPKlQn5Zsc1oNeiUl Mbbn4Cx71dSswXmpRtVoUPUmY7f+wzPGnFaW8bbRkeqKT401mWJT412pDmPbO/qYw9/qY34p 0Z32y1bVMGhacaZ6dbRJ0RkMrWmJST0GpY+aZIuz68xxdke8yRjrsHQrndZ2nitF9JHiclFf bePgFl/HYd0GvVP7i6Tr97LMjs/us9j5WF9rRPhbOw7dZ4YwSxENEUgWKssurlbtatGugW48 SxTnmvm4TJ8/63uL2ZKYkeqLtvJ4nYVZ7BZlp+8R30s+1WfxWWJTK2OD+iArLi6OHTAgP3/6 dEfCAAeko9B+sMBRCI/nTKdXIcvJyYqPN2guz1bT1RjVl+H39+vPyc8JRp+arlth4vYsjycr Lkq3uO2TU9ToOF9KapaNm3hYZ03KTvP2SI7Rnc7f548NiXfH6FSjJYoPan8myhql08e443Vh c4xJVU028+a208XfgO0Qf7qF1ZXGclgRezqQ7Em083Eeu01crLgkWnDxYq7i/4gD3ZJdAZS7 Aih3ucy5onKuqJwrKueKyrmicu4D+EzIOvbvhmb+Qnh6F2qCD+2yRdiq8Y+7LBp/tsssWLEH rNvN+82KOTn7+969jZnav0pX9Gnl5hZjNSs+WKyt2wE8f/qHmtMKXsshAXNOzgDScKozRudL z/D3dfTpV5gO77nEek5TeZ88xedziMUcd0zquKdoQsPSUe33JnTvnsD9y7c2FMTnDOvRd1pZ t/a25KIpo8MHSir7JY3PGnFqxYuHB9WU+PmyIfMqh/ZwebJ1Z2V7cqvXjsurHlEUG923cpHC 88f2TWmf7hs0oe3dgTWDPe1FKf0rGWf1HYd0Fn0advGsXSlsUE7EKzkRr4C/FF4BfyW8khPx Ss7D+IwdwxJ5Pktnfp4bjqvS7eM9WF/Wi+e1RE3Cln7toADPp+nb3zjQu1eWM8bQaVsaXJFt Kjawy5mmiHmLZaWzKHqTMzDz9FEbnrtkXNWVr5xRdMqUcrdJr+pMZlNMwYSlEyZtnt2/b8Ol U8ctq+hjM0Yb1D32xNgYZ/dsd/Wt31x/05Gd01zeHu6YuORYZ0pcVHZ+dtl5j647/aEzhvnz /QZHGnagWGWXYJXFMg9bFUgtTudxYuXEiZUT58Sc42Ix4bhEzDZun1g5LJl8kxzxTXJkxSRH VkxyxDfJ+/C5Pwq+sYRjKtyt3N+ip1UiffGaXBHTxYl23JIwdloAl0y67dDt7V9pjz/rzs+u r9jdZ/Hd5+1sWXd34wDlmjt/ua2SHvTkWz7btmD3OaOPOIZuFH/mKWamrsPMctnKluTsyBPN jow6OzLq7MiosyOjzm5VHIGoqDhvnBeDT27lpoB1o5/v9/OX/dzvNySJ/6CxVmSDWgxHV/30 pY2YVr52jNgjq197zsqvVrov3XGCVNfpoq2mti1ihspck9Wk1+PSbuBhE44GXRT0eIWbrNG6 EbHuWBPN1hTrdsa6Hab2U6LsKXGxyXZje2+Tw63Nu+OwWo15Z7NpLca4yLzjIvOOi8w7LjLv uMi84zDv3dZUlpZqxNR2xcUlGVp5t10ZFUnigIy8kfIPOAYcnR3/1WTk20ZOV63GxIzt8J4R g9d0wOT0JidmOE2YarlmPRCXglmMNNrdrji3I6rtH0arUa/HRXevmGVqZEa6iXhL5LPW+4p7 c58lMilLZFKWyKQskUlZIpOyiIeZkpBpFivaLFa0WZyF5mjUMYsVbRanWgILuHAUBuLExe7A p/MAylmC+Gd2FAi+H2UJPSpx5OUGbPst/GULtxz//sASOFjMcc69JtwTcdKxpTA966hzOvuJ 9rkLNil1E03O9MRkr9PUtgsqSfjK5MxITEp3mpRxmvegkk0W4SSLSRna9pjUurelajusGKSO +I/XwH8uNnFPccKEhJ0JKou4kEVcyCIuZBEXsogL2QPYxdEd+/fAE9H2Sm26mObRrZv1q8nw GjnuKFd6QlLn0R4boRiVseMr/jFG1Y3V7MUL6eSHk4rhOPi41BhfZdQ+XoAPdok4bfWR0xbL NKfTu0aMziADIC1SOjbSj1NKF1em9M/LMBv1iooz1ZTky/Nk9PLaaQpxUbx83MYpvaNsDovF kRQbj+jHFmtz5FUMU28Q89FhPuRfQw523GC2I2CvG7pkqGLt1SshPz86LzExufUkj0uxVtMy e1ss0WK1RovVGi1Wa7RYrdFitUaLyePNHUgSnsjsV2FOTLDmJ/bOM3i6VXiCcjEWxyKMKYQf 5PsXsYz9qHIMGJJfWCiim07PzsdFRIPYhvuO28VacMMLRZijecyQY3J6khLS40xKe6FqdqU6 XWlOs9I+gmNlJiV644y57vneXpmJUXyVnp9nTvb4kxba3HGWY0tg3i9bjdFGVYeXFcLHbUft t/fItCR3cx+ZrN6e1iPJHBWX6ors/A16BxvCzt2VbbM5I87U2BZhq8aHhDOdEWc6NWemRefl FQhnFiTaxAUVC+wWoVClQFSxs7Siyug8W7YuSZx04kDX3Cec9yvf5RdGjnTylN+f7YuPd/2G v9LUhEK//9g6022wupKt/ZOzfT5X+3zvsBRFUUxxnsRET6wpN7kyNduT6uADU/sV9E7kOOjj PEnx3ljTCCfiZXNqQbbywYD1g0ZeOfrId0ePxru7ZUQndPe0Pd2noW56/oTmCcrDiCbxrsBy FH+h2HFQ95k+HRsjm60LJDuFD5xiQTnFC90pXujORHJTYSDKy3qxjYg30yLOTYus1LRI0JMW CXrSIs5N24egJ5ol8e5hW5WvledoW6/zi336Cfvv6AcQ7b3eKcrRfTZ6y3tbL399U+nore9t veS1zWW7s6devWTJ1TO7+6dc1bj0mhndlCuvP9Iyc/LtP27fdnjnzEm3fXfXooc2ja++aN+8 xv2bxlVf8qCIYfDGewr7L4V1Z6tbMg2RiRgiEzFEtpwhsuUMkYkYxBJIcKQK96QK96TaLVY+ NlVEyaniK5nMkdXKo3cZDBZM07zLVWHp9DKkBWI//n3oO/ElqOsUyqhPBVbds3pLVFx6kjgW eyRzV49xCxaO7b570OTpuTdeO35eeaa6pf66RYPb847uCzxqY0LxtDWTJ5zSJ6bt524jGhjN WGfGjPuxUnZZIM2e5+hvwqj7i1n012bRX8yqv3jK/fGU93QXnw26FzuEK6AcEdc4Iq5xRFzj iLjGIb6qmZJnR/xz/5IADwQShsADu9MrEiKHjBb1iGD/V7H+gMgu0T4q5am/ckl8QpoaCfkT 4uLjeR9/tt8vgz2zwZmZlpzuNOtWuXoOrR60TDoLwV9c72HJY5aNz/YNnzbA26dnN+fyGFN7 W+nEpOLCy+4sbRjuwSGDIzkKW7x3n8nFvra/HnUiQgm9ai2atLhk2LwJA50xOYPH927/KDNV PXfsggSjoX1s+qCJOG1GdBxUG7BvRrFP97Jh+Ahqw4fKYREXDYu4bljkrBkWcdWwViU3kFMQ iHPysQUBvJcyCzILLO5E0dYtDnC33S4uaOIWj8P9gNJbnOK73Nprbf+upAg7ie+3/S/2vjw+ juJMtKt77rN77kNz3xrN6BqdljRt3act2ZYlG0u+ZE7jSz6xDcY2JI4hcQhkn1k2kOMBySaA wcbCJA/795x4SWJCNsbkAGJ2QwJODAvLAonR9PuqukeXxWZ3376/nvTZX5eqe6qrvvrqq+8q DVZBdOnnUYyqojQoyms5fxWq4rU61M3hPAENLlVxVZytDnS1E/Pd8sRi2xhKSOsQpuAKhzXR ZHKIvcJiVp3USUzijRkLVDZtg8xMbJgzTRMFs7Zpx9eH5m8cmGfXwuanMpT3bu6sHmoKly26 acONi8rn3fTlJcmBnjqzQkYzCq1SW9w8VFvZm3GVLb55w82Ly9Et130RDDh/0BHx2TwmZTAe 8lb1llctmFda3rBk88K+O5amjE6fWcs5zCawWApCHk9JY6RyQV1Zef3izTBHRljrrwLnB6l1 Jx08kNfBYaodx8rCf3jh442UAxMYc77ChBVdj7S2y0C5eZ8Q54dJ9mxyQs2dVN/y4oxouK8S 9fz+vMYDJUl9Zw4S5Z1ot1e/NsGIa1RcgdksOkCwDvQdkNS7QAdKUkd5z6oU8uNV68er2I9Z x4/3fj/mGnwWj+emaqrAaZRNGrBNGrBNGrBNGrBNGrDtFM1iLQ7rszhhh1dDE5roInaRe5Jv iPoqSfDkJIsMoWv1VctMVUq2q2Xf2LZbnrq9WVTwzaqixds6urb1JQlpAqBJvbH9uX2NDbue 3cGE8uT49IPldy9LFQ3uH2DsUzXDIEi3G4EqYWoD7wljwRYPIxe+Rl0obkdRPSpyoiIHco5J i5QUsNhz5GtwgTfhKqfD6YhGfIsccpOov5pqspwJiQsBj5AaGkJDQ0PJoWSEqEEyvLlXVk5R fspsNoWSPikzOGMeW8DB6ZRMbpkKmeLBgoBJLUOjCN3EqEB0+cJ6RuXFjhwkk4NCKXuauHrA eLv6giyL67GrB4+xHnTGSzDGOuqGZ6J1qGxM+IRvwgs7AiyowoV4MYqwpCaCgg5cSASRw48L qVKUKkGpMEqFUNWiwkWhEi0z1RwBDSYLMwc/2IUlQWRCx2PypZnDnD5g+QEZW5Dw+pIFBlnu ffovjMGV8AeKCoxM7jsKxEX9vrBZSaMQQhZGbYl4CwIWNYMSNPIwCnPI4w2xSB41cFgv4QzM zz8tzpdlf293YaoYtFfPymq1RqxIG7VXfySbp4Gy3OCyYwqVwEr/iFh9JbwnUYwSaRR1oKgd xWwoTqHEopCW8yziJl14MGQ8j/Az6axDaMJXN2W0E0NEzO/0clMi6A9btbLcpdzrcp017A1E jXI9Wp17UqdkQUBFbRoFsiGLXGMOenwxTqbLPdVgcxnlYDKoaWZ8HNQuRm502ejFdNbmNsoY JQiFAvQ7lV5J5nv8h3jPXgG7S5b5MVVO8dRTvN/Y6GssbmS0antGB0s1g9d7Bi/1DIv5NzOG PubBiI8ZKaSjsESgaqWdp1bSemul1V2b5/naMVrFWzj7D6kMm6Hnnc4gKoMymfT8wjHk5o0v B1EwKPNcTnfWv6brkVHFee/FFY4YsMNDeRXubHJ4qEbyZJTBhj4MtgImKGi1FYpJ31V5haTP STUyIguU4mZhKy+rrGKybIHb5TPM+3Jf22hfqmHr4zftsZUuqKlf3VGqU4HKqnQ3Lr0+s/rz S6Lfurd5pNG3rHf+xnqHTgc6l255tjXSev387k2dkdZMb4XbE/KoWKfR6XGFPOai/tuXnLWn sonWxY3NQN2jQN1X5JupQmwrnABhpglUSlKwUpKKlRK98O+EXpVj6BPebU1ihTjpx/49TP8k lsFJlrj9aA2vpqyayoqATF4yhuTPRjvdrWx3DRSPyXuI1AQS2msm7IVJmk3IzZj1WgEqLra8 OqzkbDaiIL5SvvbIULKjtTWmMrmtYAAolGa/wwnWQLyrvT2+5vBA/AlrZinvb+BbYs17mhoG q5zoD9ueP9jKRWsTG0CGymQgQ+XVKtE4VY2/lagOsQsOPLWtZf9IvamwsSx3dPFA3drdsL6W A8X8zItUBXXoWAHRQEQD/JJkeL99HJuZszjO3p3uMBMui440Wsvriw3I4PyDj9fo233hMUQf N3cyfyzF+7Na315aNIYUx9Q92E5PXiFowll8dsJlNsM1qhDVD8VUxyjjp+VKZ13XYPHqr66r mL/56LJkX3OFQ62gTXpjrK6/dscdAX6ormZpNqnDxuY3OCend0Y8Jn73M9vueuG2eawr6DCY HaaYLxAPnHxi4MBgMpwMqcwevE5XAV0ekt9KRaka6jDvy85DWncNXp01eDeuwdpcDeaOGsws Nc+jP1MUVSxSrVgiVrFErGJpxRZLxCrGDKUxB1q1NTG3zFCIk7cdnbDUZc8YeuTdWAEh7JSd 4SMl/DRhrk9dgqBOT3AVE41ONa6qmIeUXIEFh13ajl639p6BeNmaL69ceIBXWnyYp9SPNu1t zgIHAUfND9TzrTFnnoF29CztOXBszdbnD7a1NNHavN053gK8s2YP37x/HfBSUymm1hBQ6yhI tSSVoZ7gC4srs5UbKxkzXk1mP3Y4mgNFWPctwtQSQxFEvgEv/PlEc/JbSRo72U/g1ZaRScwn k3iM/K4lV1HAyTD9AoGic/tkR2T0aRl6WYZksoLi16KdjsurDJsMtEF9uYAw2NBUz6y4KF9P isxG4hFkgSpCgSlsZZ3OfLQ1VkkIqmSOxpzjT3tbN/XxIx3FOqVWwdCMUlu5dDO/8bEttXWb H1l78wOrUo8yu3bUr2gIgnkfC3TtXJq2uqxKg9OkNxt1WqfD3HDb2G1bn7uzpXn0bwfN++9P d6/DXxxNRYS/0HfLd4ImMPK0jcULkCw8tyS13Hlp5ZbEmVtiJjc+plZSGBkTXuZN2G8Z0Vyp bHNFr5S0+7vZdmKllWGrPHm2/H1xjZWfnbTJCatYxXErplppIObz0p3QQUbfDbqMQmn1JtyR jN/wIux6cpPxRRWIJoffrLqDZbGouSPUfmtnqDGsAx3HaLYb5Gqt2lHeV7tGybnMYf+nf8Tq EA5cMFZ/2OzilEPDn1ua0Bt1ZjeOdlXkvsIcYv6BaqAWUCupl3mrKdWGV1mbCobc5mfNqLut PAtaEiZBVlpfcL30LL6VVS6EIq83mlD3QrfMWMKUK5WYe1hCr9O8HgqpcqXbrSxPyTCN+Qwm 8iB+xaCfhY8NFkZ4LVwjxhIlU935a93it63WVdXMO3Xthf7GX1V3Xvcr/0LJ4Z8lO+aVi6Lo T5afx8S1g0KJVUoOKtnzSfiXzCNMdaCxzSZuBdGYAuSZzS5Zwnmeq4LtNVNJsLiywVhGmejE dooDY9FYzMBIvzGHzMY7QwVlQ/sWVK11m+zzK//YtGlROnPLo5tvPbqmiA2U+kuLyyK+cGbF nd2JNh9iOS6XWzdU0lZsX3ddaXuxffHKvnf8CYf64PaudQ1uZmvIFx4oXrBzcZHHZkp7Q2la Qwfql81r2NRfGuGXZQIN1eVOZ3dR/apoZKix57YlKbUqkHt/xQ3+6o74sut9Ve3jw7VZWuVM JeLW+U2ekgbM30dBj3sEduYyatfxbAYVToYcJMaeEouQYhOwLdu9opueOOyJr56IDS2+pxE9 9N5CJws7yslUZ7jV2U3EJ3FMTHiAxc24Zrqbmuwmylmc8KJyaGUeUZnEPdeR7ihp2NMMvxLX Zn4rbjvSsXx3d8CZ52fa2DPcHB7sHz+cr5m6/3Z11F9/aDWWlHcJf0F98mLKSgWoe05mQwtD G0OMTdLlpllsZnK9NMOyEy255+nNVAFlFSlllT5lle5a8yS1Apme1fhwLBgf2DruZDsIfS5e SUrSUNpZZvfhm/G2i5kRuBA1zCSAuWhebRL/nyABczDvDUcltYWJGvgPIxZeyX0FjcCIw1QJ dfczC8twdJ4oC3D9APc7khfsOGyPBxDBZ9eTOkp6bor7XxzXRBwAZB+vcTqpsjQeYxrG+Ezc 12GBnfSYnKxSGClXXp7XZ8XRwljl0xwetulW7LRh93n5kTZ/ygHmHaNUKxUhe6DYa8gLPUyD wuS8eYXGkd1LkiqNnjPpcRRObkm1dzB/fy05xHWwB9ZBhnqA12UrUaIUlfIm1APq0ctkcKXS 9leKR68jV7L9lT5Px6ggpZNo8NnRLlgaLlsqRWGSiEvEFtTK4x0FrVx+eYCZhIpB2QLtnuwJ ZZfyXDDBBjE0y+KQzEPYKpQI2WzMHpU56HKHHEZF7uBM/kBLVCZn0OEMWtV6Y+4U2qDXEtcc mEVq9EFOf+0y+fQf0XaNXs3ApqrWOdjcqVyEs0qyAzUAzawUTyJXG0nkavbQ0CSPoE+Oa9hW MmKJAWaPVF3D2c5ruyb1Qv4y6Di91GXebWK1Ujw8SqzzGDHNNy1CrdfGVEWP4ZTY6+UJ+eb1 2rBv3VsmxndIpIcEeYiY0wB/n+zFPp7ehmtD1GKz14Syn0efgJBlkeLprk5QvhW8fn5nQ2uq uiPV7Zwy/1Nd9TWS35aryQfNsLQkB3f+PZH5WTLUKhnYErPIXxZFqVllKWpO14y24NVjD5iV tqKmdM3WCcmqMBXYbR5W2f2ljuplzSVsqq+rLTywvcM3KWNDNTNk7LU1zEFQTBhGrVXt6F/o Kp4fL20uNIPw7c7vQTCDZdT9vFGcQYyk7WjmLH1GhBwbi14ty+Z3JRJQnhJLRp+clDYmvC3x mlRnoTPckSc91homY5PsNGr/B7Yn61/bniaI+Dc9f2V7mkYoINAqvDtha/ANoBCOGT3OF2QT KG5CCQ772qI6FFWhqBIVEu/OLHGiS7PGibCy7i3WIM2UAJR/egDqFK3BvvCTRqpnE0yTE59Y NXaGwHKUzGtsIUokK54IKw3lf/5afIl5o3b0e1s2/s8NlTWj3x2Fa9UT7oabF3bc1BxwZ29e 2H5zsx+9teG5u7sabz++Ba6dcN3TsX9NTWbl/p7O/atrMsP7sW8hdz/zCtAG+xb2Yd9CoFIj cYlG4hJNXvpopNFriBJjFd0KxMFAIgKih2FWv0IHu/Az/QqzuRVm4ZHPdivcNxxvns+HpzCL xeo2KRPdPX2pNV/AboVy4lZojTXf1tSwrMqF3tn+/QNtbDATyjXkZaHsHeAZBnu9dhU2JKzd B5/c1nLnSJ050VSae3DxYN3IHmI/A7Uekqh1N+8Gcvm0Sbxgkhpd3sVChFwS286FVLnINlMy 0C5LGWj5zLR8BhrYztZIh7Y+6ZOxaWw7uzqrse3M9uA9f3bbeRrNKjjR85nnF3vFZ9vOarzM fBZlorO9I4ZJVLb2yyvjrS1thTiJ0VLAKa+xn3PH85RC5xM1IWPehuYi8xK35kmX+zfRiBYd MmBEE+lEP0Y8g2uPb6pAUaPEVEZp6MY8cxklrjNi5jJNCQRgLqNcwHMRXp3sjBqt/g5rNyWJ e7LhJyd04akG4GyChjCRgn6MVqhVKrsnbHWWVNSGZoqZyPzaGo8+EPboZAxi1ti8nFqtVlnS 3VXjT10raA5UNseMjEqjURtIjlKfcIV+CUbcQb3E64q7sl0Lu+7oerJLPiXY9pEUZCNMMR+7 p8wzgnAk+IZe431ixI3E2jCLSQE3bCJjmeM+hT4iaRMarBbpeKIqwa9RaC+re1JH69KvV2n+ yPVyq7hNHCMG1n6Do2qdtrfFxTgRUpMCakM4RDIloDapS/9nA2r0S+XD+xeUDLSU2DQyHDBL ZpdWFzaXuWN8b38fH0ss2r0o3F6bsCoZ0I40CnWwsqO4kE9Y4/yi/sV8DBla1sN8252WsM8M +qfb7zaFKiPRTNwXTDYsratY3VGkM1lZndHGck5WaXPazKGSglhF3B8srFuC5yIgvEffKvse VUutOJ6guFBKonlKmouUNBcpaUGmJK5MYSbU2fWpK6F2j/6Kvb0Ua99KUWyfx2xXLnmvzp8V XXuy2R0M090Qtrw7hr5VxfoTaXvrCO+53WjCUbW9eUXtD9h3bDL+oarNHi6wqORquew6T5A1 qBWRrtEFtEH0MFzMJ0VcFH0QOc3QSrVGLTc48Ljvx34+5vugE9zH+0AT0MYwB8UwB8VwrClG hFSMJSoX+vOz4krzSVTxSVSB6ydkbeLCMyQZV1qsPolHfdhWUZtTHTGt3NkBipl80tmH12de Xk2w1KzOvhnBt8qqSbffQ0qTx2r3cIqer5KtX2kRbRR7cXtJw+4WpcUHK9ekntAIdvQvqLvh 0Bo6mF+d4x8uXNkUGeynt+VrpCgcsxvoU0T983NUSIDdDCu6PhKbiviQVyx4kU0ap1W6WibV X3I1TeQUCP/CV+GEBNAqOBRjUVyOgnGoqA+icBAFcDEbQOEA8pNaPwr7UcyItgdQADu51Jy1 PeCHVRvAsT01sGIAexjxb3gmArh9HXwwEO8IaF0dWlEAkrBmEudwDxHNISn+I5Eike44OpYk WfUTaVBTtgizvcospdPvRjRD587L9K641xt3GmS5l2RynLBj94TMallOxlylNeaA2+7llMzD MrVGp/z02zjoJ1MZNMyAzqRmwCakAanHXTod/Xu1TsXQKi2mdgXYGAeB2i3UG89RbSCe6mFo 1dj5lahGVfgaSaNoAEX9KOpDUS+KelCsAMVlKMGg2nloXi2al0J1+PshrKiHldwH+MprgF1Z P7TAGqVqfOV1eCPB1cb5HeQ5TMwsu5DdyN7ByljeZGtnyzsiHbVHilARvleEpSZrtrXfULSj iG6BWnu3GhP5FUzJobPZ7HmgpEjvydCqGFwVf0RCKybozMSUU2KRs5B8SlF+UCbPfczo7XGv r9CpY35A008yelfC64vBb7k/y2VgXdgLgiYV8yuaPkerTcD2PpOKfpVGF2m1OeByePC0KC3G yUmh71Wrx0cnp8hoUaq1MENgqY671GqYIT0IXpxS6cj/Rqs0ZHWAlrMH5itMLXqOcgPnVWDO dqOEGzmIcehAUUOlgY6pkQtvObUu5KyG6zwn8nU4NeYOTZdsIdUlGWU4WpsUmRIzZ4ARV32V ORoFymQmorRm4rWwWZR0+U5FaZnLz9GKPWqWyb2gYsNeb9CiliPEfKLggv6CMKfInWA5uc5i QDUyk4ZZYXUY5IzKqB9P0xfNWjnIQRNFI43wEXpNPgw2doIynJBH3D1sK3Tr9Zem5G8x0QkX yYwjJT9Q4iMdBSYlh1TWUIE7ZFUZ1M64z5cAijkSPl/cqUbb8noRc0pn0skVOk53tSaQdGu1 7mQgkHJqtc4U0LQw9wYapS5RbkrztNZeQLEXzovJREqlyCVV5on3jioMdu6QXG92mjm7Bsnu 0jrCLmfYrv2SL5NOOV9SalRk4pB5n9vPKhSsH+um7bnfonuZB8DKKaYCx8KW5+mF+FuH6N0n NL5kidxIFZ+Hl4JEvvDmj65NX+Nm78q9eLz+OB5v3I/Hq9Dbuc/L9SaniXTtgM4edjqga4zf X4THXOQPpvA1Nd5DOvtTlUYpw7oh4iY6S1PPCx9LfY1R7mOUZYzefVLjDYE9aWynsuez5/EG WzZ7L6dN0TX9m/n7tf2KB8QKmBwQVK4U5vi/gf5sgNnRUvZjONXm9LM4pUbNgASAriTP4Kma 4j/bUNxQl8b/b20rTrfAf9xGCzpOp+l6ykgZjlNK7RUZhVPpJP94QPwsTqyh0yYuN2yCH/QN lR6Y+s8xry8a9So4F4WAX6/IaPp2aIV7Glp5DhVQn9WQjDabP82aTSYzc0ZtVMvpymgoFI2E 1DhXnqYOM9fTD8q35XnfHW1j24D3z08lK5M3LmfU2Kz0AQVrN5kcRoVdYwnYHQGLGuU+N62u JMrcPWEU/CxfypVOr2NZGAAlvCv3yTupJdSN5CxiMa/pGM14dzqXK40bxhBzYkFPImEEE1Fx orln5E/G1vzpA2L2lJaYcQghzUwoVVKOXQNTMalniXWgPpBQhCh5xZwXZCF+m3xEn8kbQmkG HkDrvfwNHfGaCFs4dN+Ng3f2J6NLDgwFeweuKwJdQ6dkfU6bzwIyttSbair2aTQmrYKW6/wu SwnfX1M4dNNoU3bzqu4K2LKMvpSvY22d25puLa3oKLZtDTVf35RY0Ma7MzesWhYpa0qYcm+i /qq1QwNFlYPdLaGGzQPl0da19fPWrLiuLLFs+UDc3dLTmwhr9GoZrTTqndXrbxiOh0u8Olrl cDq9Ro3KEKpLB2sTdluiYeEahnZX17cmEy08H/ZUJBzuVN14PLM0G+I8CXtq9ZrVaX82yzN3 4W/dEvSKnfI0tYmchr35mc0HHJExdCtfmtY5UtXUbke/o59qXbv1TV/cV3r7u9zyd3t7u5S6 A+nNYTnnAxiuf3f9wb6u94aBG7MXrhDbAOamjKspvkLOlGHj4cxZXH2G/flFMCne5HDCJJJ0 Y2ku8qkU9ipR8CsZBdaKZdLkTIuFi0HLMNk9FWSfJJasTIoRVSHFTi7asHxHT6K1MqKMd7W3 BJKN5WGHxuCvXryl2z+vsszFyQqiJqdBTi9jS5oSjWVBm6Z4ywtHto/dM9JSaFOW337h6x3b ByrB+pDTSKbU1azev+D53Pg327W+6mV3fO+3937rvYe6x78f7S0HyyVkU1dkHWXV2ejVTxnU /MW7dywvN4drIvGaMMsFSuraC5Mbt29eVmX0lwQGDQaZUqPMZQYWJ1qHblhfNvB3O9oyy7Ye OHTHptjGsbs7OTOnNNo5g8mo01gshsFv/f6Lmc8dffh/fG5d7cIjPzvNNyfmL1ra5+vs5UI1 MWYRrOhbQKv/gdxPZah26uhzVCeoLHYj3bOqEyW3ZdH1WdSURZksCmdRdoxu4i26ggLdbRXo 5grUVYFqK1CyAlXAjWc3UcgPAgsrTOJ5hLdPQjNUiQ6B8fgXsCXpHl2tUFIij44h6mnzsuYx ZD0mXzlxDg4k4tAF0IqG3iSajwmn05ASPg2SnGImymaahcoZXpy8L+sHmfWPbu7bs6I+wprS C3c8uiHSzRcZlDIaKbVqbbSyp3zo7v4E45rfs7T0piPLok/YK5c3Rjpbsq5AdjjLDzd40Df7 H97VEe9c/4VvDS/+ztcO31CnNpq0eqPZYHKxKgNn6N737RVGr8NYs+7QqtqVjWG93We684mb UiV963CMdhHQ9pQ8QOHE1Da0/zmqEps6HE6kgQLOtasYk2oq8jWZfE0mX0McPdykw6eDJL3C FHWgkvwzJXkjamoNCYaUjNFO3mmJkyTnODHRpDJO246P0Q7e5TWGvF6c828hyGvxaqrJM9XY jLB6QLEmH5Qq8QerT9FNsP4vPIMneXLSJ7JypdyY01Lk4TQJ0Tdii0OD22gsgUYb851uzHe6 Uep0I2Y1ToP1QE1FvTw17lzWMj7BLDUTB2ouiAbJtFRduLBTfICYeyb+sNbUrf9a0c9kJjJn 7JWV+FBlPnZcyZyq2/zoLSNf21Ab79rQUreCD5SuPXr9mi8NFeHEmbaNXbFfeqoXV6zf6K4Z qFu3vjDYckNzdmW9766D+w6g7iUHlqcLF+3sqb9+aVfQ19K3orJ5x2B5cd+GbPnwkg5/qLN/ Jb2ysLnEuaY/1lRX48vcPv6NdNf8+oCvobGjaPXNt2BNDHjpHDmjkKQu884ZzuZI3tmcwjZH BHNHCk1xI+PYiQVb6hY8eRZ8uBV0OVBTKL/opPBLzOWXvIl+yVyH69tYbwHLEn/HB6/W4OMP PMWQc8VqnLOjWaihKWJvkiM4IkOcJiue0lCaVJEb/1lG42J8NiB/9GEynxT0d1joU338ZMr+ HY+1bIrjUcacK771qTtve+z6ZMn6p/bthutTBneyrqek/+Z6m3f+uvbq/nrQ3OgvPPDRsdUD 3/74kfs/Jtfvrn5we3+Vs/ee76//8k/21YabhrfcBeLrCVi2D8vtVJp6iw+HvSjsQeECFHKj sAuFnVI+ZYLQ3uRn8erCuRKY3CWIwqSlEpLXJyERNCH5PxISQROS2yOBD1MYvA78IYcWYy0n rSO4knXFSetoSv1p6dABkB4+8QiHOLNpDGWfCS1KsGNIKR6xLMuOnyc+N/xzHqex5DO0xcUw aV8OSUcu8ynanFKhEO3KqogUk+KIJf+wQqNXjq9Q6rQKhVqvQoa/4IwVRgEqeKFMZ3KYHH6T 4jJYMvJm7FVTsi6zycWpmV8+oJHpvXbOweoULzAyGeyGWsXVL6lBLQVq4+/BfAh4uoG6n9cn KlHSixIebKvzY/ltiEc2zMU2InlsmEw2YMNnyyMAVI1E65pT9B2UViSOFlvmWhxp4qpr/P4a YL70s+U2RXoxC6pgPE8h0UNZLAoTECDnJ46iEhoRG3wacbBZPSN9UzEhO5Qkuf0hOWjM4xUG q1HJaIy6qwM31ZgKKnozJHlTqYWdR65yzFt2y7zhe4fStra7N56ny1VGrbwTZ+4rWa/N4rXb 9Uiz4r6da5LJntpgMB5UmbxWo401WMMhR8WK21oadn/pyS0X1SaijeOM31/ILVQh8OtVvhY7 PFIoVoTCMRSOokgBirpRiDBuxIEidhS1oagVRS0oyqKoEYXlKCxDSTciXGwSuThlc0DB5mel nAoxl+LSSZxrUZBOs2PCp7wHnmDxtLBYuLDYDchi4cJi3x+LzzHHKJnIwzIQDPnUNF6Dc9Nk JcUxd3oMaXmNLBlgWU1gkUbMMofZKL9SVoZlA5YMkjcUHyk7T66TMzPjB01PyJqYMjTJwzYU QgHmFxbTffmTd+OXdaxeTis0SvSPcrO3yAvKOHsfZ819nc5dhx5DmwLR3L/kXYCIVbBeh9nr tOsZE7bL5WBlffqjEP3OeC3m5HUgnb8qNwAnn+H1sSoUqyQhQIZw8rMiI1dJ3FpF/jQDPnKE j1XEgfRxqI3jJIS4YWHZxrI7ypiy2Q9ZnaLLyclPScaeIHkL5jEcEMR5QWZHJT5xqyuq/dCP c5flRX0O/OcG8udciodAq8aha8RelHbNs0MXLpCiSFxM3VkPgYpbY2ja4WwwHKUkIOarrfuO ra9bv6TSqCAnQ5Wawrab2ps29aVjfXuW1g9GCxw+D12vMmrkFlPOE+oo2fjoxhr0yI3f2FjL OR0GHecycW5O5fS4/M03dDaszPp0rghtDPjVsDjC8dwDcrpi9RcEIa+v0grmxxSm/FpYA08C 5X3Uq89RnPA2r+ECqJtjWelw1vRDW29L8vMTwotbiWOVHct/imVFFyD5FCt9itzWYt/tNhYv HIXktg3kZzaApig8vySKjlWS1FPyjEibcL10Aj5jlXNjKPWMq087cYiGiGoyC0nJz5p3t056 WklafkCKBhCR8yQjVytyabnRHnYFoxytQJfHv2I2yzUGNf2BwapVyM6aPG6n4epLOqOaUejN ellnPGwGeaMwFQA1JQ0VqPlT6S81fV0EVPyZ8Ba9Zgr8TASmaxY4PgmyJQQeng3kslngmKJ7 CpydHZT1BN4WQXVqEtQBCb47G2i8mifzoLXPwQz40WeBbqXuj9eCfr8IhtAs8Oh/Lxi/ci2w dgJHZgfOTuAYgQ8nwfSK+fpp8OHsYDlsOWwNW/9OBNvaWeC3/xWwb5wNHFFHbhKca+dgDv6/ h8dnhV+5il07XEf/C/B9gDf/O8Adc7+NoeDH/y/Bs9Oz0/u1/zvw9flV/sf9jwduDQaDhcEX gz+fgzmYgzmYgzmYgzmYgzmYgzmYgzmYgzmYgzmYgzmYgzn4zwGJIyOKUjdQCH1eQVEqpoSS USbhfcC1lB1wl/AO4BFhFeAbhUuAR4XHAG8VnqJk6EHhp4BPC78GfE54lZIx/ZQR8CClA7wF 2uEomfAnwCPCy4BHhT8A3iq8DXiXcIHiUBzfhXYwPk3wOYyZfuF3lAn6oAPcJbwLeITSUCao /5hyQJv/BLhWuAx4BHrogJbfBrxV+ADwLuFNygFPvgh4EN5bAM9fBmyCZwqgtUuAh+EtBYgW 3gDMwrsKkAvaLEBe4TeA48JpwHtJ+TCpfxB/FnoIraEz5FPncBnG+BYVhfbvBWyCfkahV18B 3EXKw8I/A94Fb4/Cu14EjN8VhXf9CbAXWo7CW3DNYVJzRHidikLPM4AHhSyMXwY1tdDCn6ha qH8L8CC03AX17wCuhZouoMCLgDFtu4AClwHvgv53wfMvAx6EtwzA8zcBrhW2Ah4BGg7A8x8B 3gXtD0DfLgBmhVcAu2B0A9C3VwHHgf4D0ENcPkzqjwD1BtCDpP4cxvAWGvBg7irgLcL/ppYT OiwHCvwJ8DD0cDm8EZdHYaTLoYdwF9p/DfBe4SLg08LvAZ8Rfgv4HMbAPxpqGPr8PuBa6O0w tPAB4FGCt5L6XcK/UsPw2XcAnxHeA3wOKDAMffgYeEUGHDsCPbkIuFZ4AXCX8CPAwzDqEYAC agRGjb/3jhXwt9e5BPy9eV4Bf3Ndr4C/M2+bgL+ZbzvBe0n9IVI+TJ68h5SPCPhb9U6Q8mkB f6/gGQF/6+A54ZvUCFAmDXip8EXAA8JtgAeFCsBb4L03Qg9/AbhW+CV1I+H2G+Hua9Qo1D8C GNNwFO4+BbgLaDgKPf8Q8Cilpkah518EzApHAbuEbwP2Cg8C7hUeArxNeAnwdoL3Qn9Goee4 fJg8eQ8pHxEeBXyClM8BD4xCH2CGoLf3Ax4QTgIeFMoBbxH+ltoKvfomYBNw11bo1eOAu0gZ 03MrmYut0KvnALPC04Bdwhhgr3ACcK/wY8DbhLOAtxOMe7UVeoXLh8mT95DyEXjvVugVLp8G ftsKffsJtRX6Fge8VBgBPCiUAd4CfdgF/TkHuItgvKJ3wXsvAPYKvwLcC5ywC971a8CHSf2D IBl2Qfu45jSsml0wXz8DfA44fxe0+SSiYe1/CPhB4Qpg6APgM8IHgM8Jv0ZGuPse4CPCR4Af FD4GfJqUzxB8DjALdHgP8F7AXnj+XcAPCv8GGD/pJU964cl/RXF48peAWeEXgF3CTwB7hfOA QSoC7hXOAt4rvAL4MLl7RHgL8GlKD/gMpQB8jtKgONBnP+BBYSfgLcKLqBda/jVgFsbSCy1f AeyF/vSiXsoMeC+MqBfaxPVAE9QLctuOlpOxLydjX07GvpyMfTkZ+3po83XArPAyYJfwD4C9 wv8CvFd4HvBhUnMEPrseWvgI8Anh92g99OcZtI20vI20vI20vI20vI20vJ3c3U7ubid3t5O7 28ndvVDzMeAzwieAzwEl98J4f4MOkbk4RObiEJmLQ4TChwiFD5G5OAzj1aB7oOcXAbPCP/0f 4r4GPqri3Htmz+bs2a8QIkL4KJwAYvhoiIiYFyIuGBQCQoyCFK+YJdmElXwsmw0kyMcxRgyQ 2sj1IqXWRi6laq31akvVWrsxNCBSRAw2EqohCiqNGBFjrs3l3P885+xmA9jSvn1/73n8z5k5 M/PMzH+eZ2ZOgicIh+gfIRwOJmvBsIiv0z9AuIXiWIERhsFSLRh2IhQM16LFbISwPYRBzEsd Wv8M4Q79U4RhcFhH7dah3Va+Ay1+jDCBwiEoswMtnka4DjO7A22JJzv0D/kOaGvgYZRvRyjK h8XugHA4hSnoQ5j6GUbdzxBuoed1GG8Y67ADYZi5EDZQuE+E6K0X4WJ9McKg/jZvgP5PESag bgP0n0E4nMIUWFED9Iu40N8A/SJeR+EO7OsNpL8B+hWEQn8DsdEA/ZgV6D/K90H/CYQJmPF9 0P8JwuEYyz7odyDMpufr6PkWCoWd7KP+7yP9+0j/PmJ7H/SXIFyswzOh/x1Yp1WcCbATDkSY r9+HsEwvRxjS70VYyRzSQvB5VFoohfQD2D+szIUwUT+GcCq7AiHWK4T5eiHC5foZhGW6H2FI D0iLMZstCLOhfzH0NCMM6y8ibNBfRbhPxNGTH0hB4dEIwxSKs4q4vmsZycT/RyKufAolOlnF U0rELSxesppxiaVJiWbcGlMmDueVmWZcjnluY99IS8y4wsZJh824nanWO8y4w1IfLe9ki6wh M+5i46wHzLjbst16zozHsyJbrTj70TXJ1m3GObMp48y4hdnsa8y4xJLs95txa0yZOOay/9CM yzHPbWyd/admXGFX2tvMuJ0lOEaacQfPjpZ3svGOSWbcxa503G3G3XyeI2jG49kU52voCbfa TZ6NuMGzETd4NuIGz0bcGlPG4NmIyzHPDZ6NuMGzETd4NuIGz0bc4NmIGzwbcYNnI27w/DRT 2SSWBklH7Fb6q49BVordvJQVYP9U2U301zKNv5npxRM/YiUsFTkzWBFEZTl4VogTQwi1RMqH uw+lVyHMR8mbUK8IZZbhmR8l/FTOCxRDVz6VLUGqDM9KKM+o70cPVMCLcn5oqERqNWIhtKXS 3+hchngRyqrU53LUzqe/AVpIWkpNrSGUKDbbFCVUjLGU2vTR3/oUY5lDYy3AEy/9DcogjUKl u5dGKdo1xpGHnAmkuZieFJFGLzgynkdaKYaeImIsYPayBE+KqVVDpxhnKKYHosUAjSXyN0oN to2+i5ZKwYBKf52zkFjw09/jFH/nNEQpMeJQdD4MzoxWVOp7iTmuUuJ2GZXs7XHsiARrFVTP GPUKpFPJHmJn82rSVkwaKomHcnPmY/kWM2aM30f9F+M35iVI1iDuRotirlXoCERHY/Sx0CxT htQaU3sIozBmaFV0lrxkI148Le4zrog156EnXmo/z2w/lSy2kOZK5FzsA1MvGvXUqNdcxxaZ VuQ37e06aJyC3Etbvc+0X2M0XrP/hZRr9MdnMib6mE+WK3q1guYsUufSuQX/kAf3WosxNwuR 8lMfRPu3k7WH+szjRLMHpTEjyDP9LkSj9JEtz8OTPJZCczwWZfJJ/y3UK6NuCBIAixMhq0lS ycf79jyVtBejDM7x1P9CGkEAGirxVMxgAY1FeE5frZHnBfSXgoNkvxF936M+G1ZbSdZWRj0M kV+V0Tpg1FZpDMInfWRRfmrDYGgZ1Y2wNwv8zcOKaNQNxuQY/pxPnPT66GrzL+wu/5Z2jbQo mwcrKicO86M2n0/5AbLYyhg7D9BIS0xLN3T5KBSee+G4Rb6xQqSg1liyzmKMyxf12Yt7VXKR 5svnqFd7ZJVWzXXWsJ68PuvdxWPvtde+/ZoWw4AYiTEWY9WPWH0wuoPk0xpaQmup91tHavDs 7cOpz7T+C31AsCosr5xq5tN6JEbji+oRJYtoTftbM/Sv8oten5hIvRE+YOxEqTRXAVbxtDop LS1dvdWfFywtKy0IqTeVBgOlQW/IX1qSqs4oKlJz/IXLQ2Vqjq/MF1zly0+9yVvkXxb0q/4y 1asWl+b7giVqmbekTEW+v0At8Bb7iyrV1f7QcrWsfFmoyKcGS8tL8v0lhWVqKYqGfMWoWZKv 5pUGS3zBslR1Tkgt8HlD5UFfmRr0eYtUfwht5JVNUMuKvehBnjeAuKhSXF4U8gegsqS82BdE yTJfiBSUqYFgKfotug3tRUWlq9Xl6LjqLw5480Kqv0QNiXGgZ6iiFvlL0FZpgbrMX0iKjYZC vooQKvtX+FJVc5hXl6nF3pJKNa8cgzf6HVqO9n2r1aAXYwn6MWxU9Bar5QHRDDQW4kmZfw2K h0oxoFViSF51tTdYbLQlaM5b7g2iY75gao6vsLzIG4zOwNRI01PF1Fy3CBRhUOp1qVMmxVDv A79oxgv9hX7RDx86FvTm+4q9wRVqqciJSRZceoKJFoxmYYk/hPq3h7whY4wToaCUGsjD3IWC fl9Z6rzyvBRv2Vg136feEixFbigUmDpx4urVq1OLI8pT80qLJ4YqA6WFQW9geeXEvFBBaUmo zCwq4gVeDGCFKPe90nJQW6mWl/nQCQxJZKtezKQvWOwPiQ4tq6TuzVo4bwZyg5TAPOeXGzO6 erk/b3lMXdz9JXlF5fmCi1I1318WKEIDgvNA0I8CeSjlKwmlqpG2S0tgECn+saqveJmo1Kuq JFL4kj2i4sKkQX8Z6Mkz7C7aOvFq6ppGHUjxoxWYvqA+KBwkv3R1SVGpN7ZR9Nlr9BTER2eg tDwUKA+B9lX+PJ8os9xXFLhgQJczFzQTE/N9BV44Uaq3LFARfR9kehLbyC51cZTAGwW7gtl0 nfXDu4vxFsXw1sx4gvGz+b9xWaVzLhdHGUv65ZZ3u0V5afbllu/XT5S3Lr7c8gkJonzc8sst 37+/KC9XXG75K65AedyZeKu0UnnxVj2dwv7MzRLZEJaE8/IwNpmNwUlhApuP9fkurPbLWSbW 51msis1lP2B3ssfZEryXLWV7sHo3Ivcw1uw/Y/U+jdVd5xbu4v34IJ7AR/MhfCIfzjN4Cr+F Z/M7+BLu5XfzEu7n9/EivpmX8sd4Od/FV/Ff8nX8Fb6J/4Fv4Ud4Lf+A13HxU5+v+K8tnIct Lt5gGcT3WVKkLMt10kLLTGmRJUu603KntNiyTApalkshS4n0mCUkbbeslX5k2SR1WOqlzyy/ kM5YXpE6LfukLyzN0lnLCelLyxnpnOWvmEulLx+S6x/kYzP4eAx87AIf/wU+XgMfbyK3BXyc BB9nWSW3gY8B4GME+Pgu+EgHHzeDj9vAxz3gowh8rAEfDyG2DXzsAh8vgI/fgY/94OMd8NEG PsRPzLr5DosEPhLAx1DwMQZ8XA8+MsFHDvhYAj4KwUcQfFSAj/Xgoxp81IKPHeDjRfARBh9/ BB/HwMfH4OOc9KXEpXNSPMY/tC8f8tUxfAwCH1eBj2vBxwzwsQB83A0+VojfsYCPh8DHE+Dj WfDxCvjYDz7EbxA+Ah9nWRnUhfgg8JEKPjLAx2zwcSf4yAMfQfCxHnx8H3w8Dj5+Dj5eBh8H wMd74OMT8PFXvs5i45ssV/AtlpG81nINr7PcAD7mgI87wUce+CgFH1Xg4xHwUQ8+ngYfvwEf jeDjAPg4DD7eBR8fgI8zUodklz6TBklnpKukTula6QtphnRWWgA+7gYfK8BHZV8+7PUxfAwG Hyng43rwcTP4WAg+xBtIGfioEn+BEXw8Az5eBh9HwMcJ8NGJEjpbzuPBx3fAxxTwsQB8LAUf 94KPNeBjI/jYBj52go8XxE+Rwcfb4OMD8NHJSy2Ml2P+V1lGgY+J4GMa+MgCH98DHz7wsRJ8 bAAfW8DHY+DjGfDxMvh4A3wcAR9t4KMDfHwJPv4bfOjSdkmRfiSNAh8e8LEAfCwFH8XgYy34 2AI+doCPp8HHS335cC+O4WMo+BgPPqaJ3xOCj7vAxwrwsRF8bAMfu8FHA3KOg4+v2RJuY0th D/n8avBxPfjIAR/F4KMGfPwn+HgefDSAj0Pg4wPw0QE+/ocvsbj53Zbh3G/5Li+y3Ag+ssGH F3ysAh8PgI868FEPPp4HH78DHwfAx3vg4xT4+JLvw1izpCRpoTRWWiRNku7EnC+W5ktB8dNP 6S7pMckLPu4FHw+Bj93gYw/4aAIf74KPU+CjS/rSKkvnrAOxfI7py0f/9TF8fAd8pIKPueBj ufhNJvjYDD5+Bj5eAh9vgI9TbC6X2J1cBR/XgI/54OMe8BEAH98HH8+I36+AjxbwcQp8dPMh FpkPtyTxFPh+tiUdfMwBH3eBj2LwUQU+HgUfu8EH1g/Lm+DjPfBxGnz8lddJdr5DGsR/LV3N w9J1vEGaBz7ywIeG0W8FH4+Dj1+Aj9+Cj9fBx37w8Rb4eA98dEsd1sHSZ9Zx0hnrNKnTOk/6 wuqXzlrXgI8t4ONx8PELsQ8rNvyXkJCSkrm2qkqJ44qtra6us6amplMk5ECNhqsmoMhcUTpr qnEhx4qcTk3Df1qfhEbFUKZHFFQ4V6yaeSkSU6yqcYUVhSuOxsaf4vrhD6nO3r27dj36aG0t JSqq6aqgHlBfhALRN0rU1dRQo7l1mkdNqMtV4pgid5u6Iz0wFIjBVVVlZqakJCQoTqY4q9Vq NcuT5bkNomoqOoy61bNnp6XNnl0tx3HZ1qlU1NRQ0zYMqkY0KFu5HBcQowjQc0UUQSEqH6jp 1rQKxYrhpXk6PeJCIVmuqKvL1QIGjdD0/H5RxaCEGZQ4JF2RVBYlRYxJ0+rqw/X1dX24kxUu O/a8sQkXNWnoMlvHJXol24y+ElGyzeigosgSl61thhaMQg5o4bSENpuV2axGZ9NIjSi9fbkc x+S4mprsbFWV7Uy212g12kIslSMhSm8eBtjbO6ZJWOQkj0dTLEyWPOL4goTMuSxpIqFxXJIG z7Fa27jMrHKPJHElrr6+XrFhrkB8Wk5tbdBu54pzOEtm87Wt2k5tl/Yj5mEZjCaXRknjRCK3 nvjqNnMUJUH1GIm0tOzsum7MNBmEsE3FrJPuoak0Et1KQgKNwlQdoJxv9wNYlC09Uww2M/1f 7AdizA1aA8a7U3sUIhjv6w+gyJ6eWYULjUdd4F/lD66L/IFKZCI7JbMqxh/scdxu02IdQjYc gjKUqEeIjNy6TpFhZXZ4xKVcIqLsW3zC2usTdiu3wydMp7Bzbo8S+X/lFcKhnw9f4BXkw55L u4X8N9xCjrhFbP/+Sb+wC7+w27jdLvxi2VY4hsPBFdcIpmrzPVsh2zxboN2DnYssoNc1kOh1 DcqJuAYSva6BRK9rCMuOuobIibqGoZpcw25ndrvCBkDEkGewDTRZdpnbFVG1G6bVLfqsZMyk sc/MoBF0VwuzrUKemO9uzfCN3lQ3aRElRbHzIug7w8KE4hLMq83u4HZXGNeTnieJia2eWohd 4XZHw5NPPrJp04MPPkCpjJn3iwvdEF2k7kU7TKkaODB1Q2xvAUGF3cbstvORtqKdIrej8QsF MzB2wYBgQmF2J7e7hf9sNj3oGk14EJiyK/fPHD06afTomffb4rhNzEQF7Mghc4cCNS/tRR/2 viSyjP21JkBZVqs1VIus2pBN5jaxC/Zo2lqHlTnion7kQUmbba2YFg0FKvroxKCIP9OXNJek 23udCe7kiOMO4Xg1wp/qahycO3rZ1mx2bnO9yA7SKmQIdcTUHelUtdGs+XzvS8JrRdLsO0Zh s3Kb6V6aiIulIlfMoJjPyEjSSB+pw4AFTcKN4Ec2B7M5Mz2ZnnGakP44nTlismGdDm5xxEX9 TLNamAV+69HsFrGtecjTPJqNcxtGJ1xNwzupBXEu/qZvGw6zcbbzVit3yHW4HAp3ONIzM7EN ba7eWOkU09pPA+PqLeomdau61fN9crgbmWkypsdRyvQ4tdvMU4QDebqFqdmSUlJmz67pUZSI xcPpFLMevM5wOyrZYxX14HnRFggOO3PAnHpdbwMMkFZJG3fYyZKFi/WIEdinzzAImTGdBtRT RT5wP3KFifRE/K2HbCDqfhoVFgV1Kn6BSZDxJURd0OHkDnc4N5yLRar+EfURmP5mVbgAaRFO aHihw84dzulmZyPXDCxZ1BfRccMjo+OAS1ZXV1HXhEfkJgiiHDbmUKI+mRDtqeHbRM7FXqkw 0cn4ajWys/V6pgN5hmcarmnYs3Ut7M8pc6dwo1jftJm+SXnWSzun08qcwjmj3mlD3nrhIRqO EWv7qv277umM407hnhH/dHLujJmM/0cOKoZaQctg57/KQZ3c4ow46D/loQqLU3R4qJM81Gnn Tmc63sIy2WyWxm5jm9iDeGt/kFVoLhcmu184TfUk3Fy3CWUfSfh3tTbsYblshEbWZr5MCE7i LA5FjXqsmWu10jZpuElS1GcpuRa9rABf5jqb4TFn0khGvdYTbYgaq3A6mNMh/j2vkGSIR9ug oa5H8zht3GlaPLmuU0F6uNdDTHm8w0Xa0b3RcN6qjd1kQcJ5Te/tTVOgETW9FqLHWMuF1kO2 mtDrzE43d/YLJ4WT6lPqU+pm180Wq9qDyoNKlUJaw1o9pA5So1VDqiD3Gw0OY3l9nHsG0sOY OTba8qnBSNrw7irqe0U1xpmmCE6dNuaM8e+EC8YSu24Qo4I//KclE6eCWxeEhlGFTs9KMCRF jKc+wZPgcdqZ0y4UGMuDEj3AmAd0cn4Yt8vGXXbDTcWOv/elPkd+yrXgmnqzyL15KtVNzxQL AHLjmCsuvXcFEDOs9C4BVWsvUF5VZSyxUfbcku6IXQXUsEvmLiVmGah2ce6KnUlNcXIl/uVw k1odI/SqEGmkz3uDszeHVgNKR0aDgdHbg7kcaObRT6zBWIKxIsseT7cxtHTSajQAGvCqoFzy ZSKyKjhjS8BPXNzikqODiF0XHBa8EXrMQzKOzNyixGnGMTlmZYiLWRlcNrEyuBzc5TJWhkyW grUhG8Yq1oabWEbYLSzDFk5KUxNumT17P0y8pq7mkbqHc43VgczToCjCktOell1nWuN5SldU gx+rWCDOk6u6BgwYnZlZjR5YKd9YIVBGmDPSxhLRq++8xRpZJaLtZRqBy8lczngWz4aSXKNd o+WGN2B3FRusS+EuR09TU9PenqbGxsamHpcdD0awgJbLwjGSiycjGNFwnjXiTTIcczVojdp5 RgZ4XqR76On53gfnjXJUvbeaHqsj7LJg0vo8gMXLSdFre8AVz10JbcPahnVmHJ7QUtRStH/e wYN7a/fVNroaXaS7LdwZPhxugRyENEFeDzeGG8IuJ3e5R7CV5qAjkhteGcagDApo9EbDgoIe 1sQaSZqYiBupBo0GlVEQDrdVDIuX5YMVLoW57HpvP5MuGGXv5dVuZDQZRttCxGQY0yImyNWP u/o3yA1y48a82rzagoMFB6e0TF6cUZGUlpRG3WxsLCjISErKKChobKSXh7VNsry+qenQKrfC 3Q7RyvFTjeI6ddx4UyqgpgsyKF/CNa2Q8guniVcYjKSpCbOzLMMtc7eckZub251rXi6RvwGm 0bQ2vB411l/YRGOj28Ld1nCYsegYE6y6Oy4tjbG03qvNbeNuu8htOtjS2dly8GCTWTHmsru4 vd/xto/TmvoIvWdF2zPeugooXpDhisk7dVxMnHgQHR/GSsfclrZIE+K9rGKvmDlXbYU4BMm9 w00n3WY7IEe8i4mfmOQxIVMgwyD2ePwnzC0vqXB7/vbJz2d0JuUm5bouXToJksbcFos7xrDB VZzELXFoM4yjGd7Ec3Ppl3H0ABuAPU4wygSpYjdAilt5nNzJxc8EdC0OE6UcFJfbyd3u6cxo s4BlsPRwEUxeeGdeOCM3Hu7S39aWlJ6WVFhU1AGHOdhy8L2WQwHyZs8IjSzKZDNCqMuRXtES sWSdHqxtApOy7EpKy9XJNeLZcDYQQxyDRm+GY+iazIRQ6fWCzLUyqjStpQfD0zAuci+zAR3K ZJcL+tPSol0ooH4UZBi/sXSwnZbFTMqrDBaxAYVB3wo2tcgbKmHzkMNvz5mpglim6/QzdZm5 sd8aKc5scKMr6bnxxILduB96O5BJc7KzZ7PROQtuVVnaHTlzVWz3RhnxO+MENohSElroH9WO kwx2/8FmCusRu4INYUPzAmUBtovCZyh8nsI9FL5K4esrfMEStp/CQxQ2U3iMwjYKT1HYIf7N AzsrQi5TOITCVApnUriIwnuLVxSv4Osp3EjhwxRuo/AJCndT+Fz0N79/L+SXGSpgUgIHMhhW mPiXuv//nlkwD+5/+C6sVvybSfGv6qrYVraTvcBeZ0dYOzvLLcxOI1XM0XYw8e+VJdQbADfm 4vcXfKpxr9lo3H/cHVMH9nZmZ580d/X0TceP6Zvun9g3fcWOvumrzvdNp1yQP25I3/TkNGa3 xKbPxeTLjN+S0Tc9bzPuDth0CssW/8YbdapAVZolm22w7LL8idVLP5Z+zJqtIeuT7GjcO3IN lxy3O7z8ZcdDOPHvdyW4Zlluct3lesJS6c5332v5nXuDu9ayN94Sr1iOxH8d/7XlPca1LsGN /K57zyXlMOSY+6MYOW3K4UvIufiRUUmBTIVkQu4l2X6huA/H74z/VcI2U+pj5Bkh4uR4CXH0 z47K5v6PRqXLkMRhl5BUyOQBO2JklyGUc4EMeGHA/qgcurINckrIQOulJDF1YOLAlEGbY+RR ktcvKYcHfRORpAFJQ6KSaUrWJSWbZJF57yuaGYpyTSTNUTFqv5/UOXjc4PzBTxhfp7xQ++Dn LiWG9sEvDW435VyviFYGf0NtaQLfmTdqalTmjcqJSr4p90K0UfeKP+452nNV6lWZo+5FmHrV 62P2X/0uybmUJZDA2DGQCWPbx3YD7WPPj9s//gkhY9vHvzr+9PjTE6wT4icMmPAKpDl1OiQ7 dcnEx0157Rrt2jHXfjJ565TJkOnXJ12/5PqK9BdMeTW9Kb156jhI+tSN047fIJPU3fA6Sc/0 KdOfNWXPDT1IPzu9k1KdN1putEx/9sYJnoc9r85InbUY8v4ty2+oM0rj3mmUmjNdlJszL2tk VlrW9Kyn5o4hyZ57L0nF3I1zH0dYMfcApG3emnnavPdvDUC2zc9Fqez5h+YfmnsA4XERg7TP 75j/zQKNZPeCgyTvL+gA3l/QlW1d0IX8juwl2cez228LQbbmqCi3e0GXkZOzZkFXzkc5ZxZm L2pavPjuxLuH3T2m0Fq4pLCl8JvIffkEyAslCSUjAxWBqkA40B7oCHSttK6ctDJzZcHKwMo1 K2tWblv57Mo9K/euPBIMBLcGnwqeLWNliWWzy5aVvVr2bmhyaFno8fJF5TXlr5WfWyWvmrDq 5lXPrjq1OnP1NxXDKm6uyK0IVjxe8VxFS+XIyn+r3FPZUvnNGteagWvS18xck79m95qW+8bd l3nf0vu23/fMfcfv61rrWbtm7avr5HWedcF1z69rWtezfsj65et3r+/YMHVDxYbntOxvWav2 XLge9V1ttFW9ItYR+qGGKcYK8i2+l3Whx/X1E8PSL7nqRFaeGOm7dmhNvSJWB625V4x1Qayh Cc8kNQ16FOvwsemdWDVpDaY71tv+2Vhft8fvTNjmPhxdM1G2f9eofFHXvSd+e+/aabCE1TmT 1l+j1Mj4nRH2xFOxFlPZYyKfypsMQu8e90dYyXeixjHSdhi924b7MZLe3eH0BbtCZsw+0LsT 7BT9vmj1f+ai1d9hrvmbab2nVZ70oHZ8JuLbIysh5uMpc76wNhnrj7G+mfOINREroJi1/Ojq GJlRrHFJWVq7qNE7x6NytHatHdpEqXPIyx7cPirnYpvAOtgcs6JeYp2NXVcvXlPNlbuJrMlY RedF1k+xruMJWtU6Bj+FJzlJ2VMmzz800GrsY3THnjXomyvbYFWJkd0nsqskDhto7d2BDKsU exuVtooSqPv6wESRI56IUuJ54jD34YilJg1JHIYdMFHUF3Hjae8+GruTir7QrmnumzE7ZyI0 XLhPPtpndzxs7owDIr1H/jdG66L9udlXtiVloj992BesCY4xUzEeG+HY8ETBpmEpo/LBd5aY TcFEUvaAHTTfT4m5ifHqqYOfw1gjO2yzoVXrSNK0DkNEC+I+KkfMiogZlibuWsdVqaMnGTB2 uNGTaFeKEbHDGbsb7Y//pNCeGiMXl6CdNkbMHTcqF9cQO+0/JrQXX7ZEd+xvkQuZEhLdx79F aGe/bKHTxmXKhezQGSVGLuaPzi4xIuzemOl/TC7W/Pd7d3li8CzOLvE7b5CzRt7Q4z4mTj0k dfREFicdStVljRRnIDMPghNUujg1GU/F2i9iQuh0tJhOVuIM1Tm9k85HOB0h9voNdXQ60aKn GCG7F2jzjy/QxAmGUrvNc44R341TULt4Ik40ot58U+jEE6KzEcpS7m4RDn4OpXeL0xRWizHz j9O5q8KUbHoyRpy6KJU9/7hYl8w8CE5uaTiriROaqLeRYhA6pwXoPIeydFKLntfmZt9oIUZ6 BBe3hQwmbpBpPOix0dO5B0i3aGkj6SK9fT3x4hmNtYOr3zVSTBbfn5Fu1V8V354RX54R352R XmPXM/H9hsP0hRYR66CvbHD6goxFfB2Gvg3jZD/Xe9hevYfnsiu4l+XwZWwwz2PJPJ/15yvo SzSTxbdYpCL994xDz4fMirIulO2Psi6UdZC+k/RlFjtfyoYhfxTyFyL/O8gfBV1XQVcyav8I /Xlf/D/9+gvob39pLfqxTv8N+jtV+lB/TPqIpUkn2STpYzZe+lR/WzqNt12h/TB9x8UqvrYi vrWC3jxKX1upYP1YFksAprKxbBqQr7/NfEABIL4JE9LPsXJgFbAaqAAqmYut0Y+w+4C1wDpg PfAA6lcDDwIbgYeAGmATsBnYAtQCL7OZ7BWgG/HzgM7GcgZwIJtN47cBOcDtwB2Any3gTWwE RuyXFrEM6S6mSPcARaxG2sCGS/czVXqADbf+RD9irQeeBI6wsdZ3gGbgKPAu8CegBXgPOAa0 AseBP7OxcQn623Ft+pG4vzBXXAfinwGd+hE5jmXJY3G/lo2Vp+BepL8tFwMlQClQrn8srwLA jQxuZHAjrwHAjfxLNk1+HvgN8DWbZhvHRtjGA/ewsbZcYBmwEggClYAG3A+AI1sd8AjwE+BJ NtP2c9w/A84AncAXwFngawAcKnlAPuADytkIO2PT7APYCLLdU/RFHBH7lL5vcyWs9kVY7Yuw tjGwthmwtipY2+2wtmWwtjmwNo/4Io34Bo34Ao34/oz4+gzs5j/E92ek1/Td0oews5NMkk7B Bj9ld5GdfURfoekf9YqlbGKM/tnQvwr6Z0H/9eKLMeJ7MeJrMeJbMdC9TXwtBvpehb5FLB5a PoeWz6ElAVquhpYSaJkILROhZTy0XC2+9yG+7yK+7iK+r0FfdhEjfUN8j4UlQcfvoeP30JHC 79FfgZ6J0HMP9EyGntuh50bu19+Crol8u/4Sav4W+qzQtwo9K4DOK9CzB6Bti9Sun0PvDkif wFs/Zd+VTpse2x9ax0GrH1qvh9ZZ0DoaGlOg7R3xBQp43q0Y5ULmNFeY/8FKIlaWH7IH9A5W DTwIbAQeAmqATcBmQHzZqRY4oHezN4GDwB+BQ8BbwGHgbeAI8A7QDBwFWoA/6zp7H/gAaANO AO3Ah/qb7CPgJHBWb2Vfws/PAV8BXcDXQDdWt/9G/jfAX4Ee4H+A8+iLrndwBnBaFT+UlsDC /k3/XFqKe67+ufWI3mF9B2gGjgLvAn8CWoD3gGNAK3Ac+DPwid5t/RQ4DfwF6AA+A84AnwOd wBfAWeBL4ByAvljPA7r+Zlyi/qbNo3fbZgFZwFxgvv6x7Q7cFwJLkH8XsBS4R++w5QLLgBXI W4l7EAghvhqoACqRXou7hvv9wEbEHwIwD7Yf4F6H+yPAvyP+KPAfwDbgMej/CZ7vRHwX4j9H /JeI/xbAHNkwRzbMkQ1zZGvVddtxAHNkwxzZMEe2NtQ5AbQDmCPbp3qr7TTwF4ylA/hMP2w7 A3yOvE7o/gI4C5xDGnNn68L9a6QxR0oekA/4MF8W9jAbQDuXxB6G7S4U3zjB/MYh9QukspCa AyvfK73FxjOOp10sE5bZCstshWW2wjJbYZmtsMxWWGYrLLMVltkKy2xF6Y9had2wtG5YWjcs rRuW1g1L64YVdcBiumAxXbCYLlhMF9oT35Zple5mcZIXWAYLytM/hNW0wmpaYTWtsJpWWE0r rKYVVtMKq2mF1bTCalphNa2wmlbMZBdmsgsz2YVZbMUstmLmujBrrZi1VsxWF2aqCzPVillp xWy0gvVusN4N1rvBejdY7warHWC1A4x2gdEuMNoFFlvBYhdYbAWLrWCxlTz2GLOByxnwZAV7 7++w9/5aOoy99m3sQthtiN/TGOHbGOEJ4nctUuI7csPAbxU0/Iktxj6ZjH0yGftkMvbJZOyT ydgnk7FPJmOfTMY+mYx9MhktTcFeORp75Wj4bDN8thk+2wyfPQGf/Qo++xV89iv47Ffw2a+w nybCZ0/CZ0/CZ0/CZ0/CZzHfbC72zcnw0xPw0w/gpyfgpx9Iy9gYKQ8oYtXYR0dgHx2BfXQo 9s5k7J3J2DuTsXcmY+9Mxt6ZjL0zGXtnMvbOZOydydg7k7F3JsMXT8IXT8IXT8IXm+F7X8Hn muFzzfC5k9jjkrHHJWN/S8b+lox9LRm+chJ7WzL2ttHwlZPY35Jh/82w/2bYfzPsvxn2fwL2 fwL2/xXs/yvsf4nY/xJh/ydh882w+a9g8yexByZj/0vG/peM/S9Z2Lt+FlyfxfnsYf1BzMBs rOcnsJ6XYyZmYyZ+itxaWPss6QhOUs36eekoW0az14rSx1CqBTvmw/p6pJah7hHUfQdPPaj7 MOruQ90s1G1Gve8x2fSjO1HyKEo2o2QWna+EzfyMNPmQfyPyDyH/XeRPg6ZNyH0emmZC0wFo SqPy79E58X0Ku5iD92Mj+BKgCCgGSoEAsBIIAiFgM3b6/uLLXuJbXuJLXuI7XnQ2qmeDpN+y 66QGzH87G4Vd+3acEhOxcw/BKXGU9AlWhk/Rg9N49hd2HfbzoN6AGgNxphwp9nTUL2JzsIMt gc3fxeZIS+n0NYfFo2dD0bOh6NlQ9GwoejYUPRuKng1Fz4aiZ0PRs6GoOQA1S1BzAGqWUE03 arpR042abtR0o6YbNd2o6UZNN2q6UXMMal6DmmNQ8xqq6UJNF2q6UNOFmi7UdKGmCzVdqOlC TZdZc7JZczJGchcbh9g44vhFOiN8Lb4EJr4jBNwG5AC3A3cwB85uDpzdHDi7OXB2c9jF72mt 4ste4utV5kljL83RCdbMU/R2PhYYB4wHJgDfBVKBiUAacA0wCbgWmAxcB0wBrgfSgf8DTAWm ARnADcB04EbAA8wAZgI3AZnALOBm4BZgNjAHyALmAvOAW4H5wAJgB/Aj4HHgCeAnQD3wJLAT +E9gF/BTYDfwM+Ap4GngGeDnwLPAL4DngF8CzwP/BbwAvAj8Cvg1Tmth3Bv0Y/x1oBHYC/wB aMLzffpRvh94AzgAvAkc1E/xPwKHgLdwgliCt5Wl+mHrH3CSaAL2AfuBN4ADwJvAQeCP+lHr IeAt/Whcf709bgBwJTAQGAQkAYP1dvkHwA8BcCA/oZ+Sd+ufyz8DngKeBp4BfoXnjbjjtCn/ AfHD+lH5HZRvQbxLb7d9BxgOjABUIFn/3DYSGAWMBq4CxuhHbVcDKfox21gAtmCDLdgw77ZJ SF+LvGn6KVsG7jn654pFb1ckwArEATJgAxTADjgAJ+AC3EA80A9IADBeJRG4AsC4FYxbwbgV jFv5X97uPT6uutz3+MpMmqTJhEuBclUoNwEF5K6AF3RbUaSKe8NG3Wr23oCmUEWgFFpbWoMg ApY7RaigVAloW20sCNhQoEibkpK0zaVpaNKmQ5LpJE3SzGSagr/9nuzKQc85r3P+OeePj2vW mjVr/Z7v93me32+N6SDuEnGXHIbDcQSMv8T4S4y/xPhLJuFoHINjcRyON6bTw9slZ+Djoank XJzn2KcxGZ/Ht533H7ZXee87zvsuKjEV0703G3NwC+ZivuNPOv8p51eHtpKn7T+DIccyYdv4 Aoh1/AGhabw4xh8U3h5/lByaNfaLdtQpoE4BdQqoU0CdAuoU+EQBdQqoU0CZsd+92x8TcAAO xEGYiINxCA5F/pfx8r+LdySOwiQcjWNwLI7D8fhQ/vcTPWWfiJPwYXwEJ+MUnIqP4jScjjNw Js7C2TgHH8PHcS7Ow/n4BD6JT+HTuACfwWfxT/gcJuPzuBBfwBdxEb4U5f+Ds2UFU/Bl5H/T 7xJ8Ff+Mf8Glxn0Z/hWX42vI/yrfHNyCuZiHH6EKt+LHuA234yfI/z5g/tcB78V9uB8P4EE8 hIeR/929R/EYfoHH8QR+iV/hSSzCr/EbmAELqvE0nsFv8TssxhLotQV6bcEfsAw1+GP+twnz vxaIV/AqVuG1/K/9YTXWoA5r8Y9d5NLw7/lfMDQP7Kvzn28e2Ff3Pz//e4aFOl6hjleo4xXq eIU6XqGOV6jjFep4hTpeoY5XqOMV6niFSzyjLMXv8QcsQw3+iOX4U+grfB4v4EX8GStQi5ew Ei/jFbyKVaiPEoXr8GaUGJf/U+8Do7JxB2EiDsYhODQqK7or9BXdHdJF871+yOsFobvoEXMS D8a62RPeE0vRr71nzEXGXGTMRbp00dKwvej3WOa9GuS73LPOf86x573/Al60/2cYZ5FxjnW/ 1+3XeW+t7RuO1WMd3kRDlCja4N6e7Yo82xU1O9YSRsY6ZZuxeZ4r6vZZzyxFaa+trousrot2 wjNLkWeWIs8sRbswjAyyYhsJ24v3CX3F+2I/7I9DwkjxoTgMh+MIfCAqLf4gjsRROD5KFH8I J+BEnObY6bZnwCxbbHb9764bJUpiUVlJHIUYhyLk/1y6BONRijIkUI59sC/2w/6YgANwYFRa chAm4mAcgkNxGA7HETDOEuMsMc4S4yyZhKNxDI7FcfhQ6Cv5sGe0j+BknGLfSqHkNK//1onP 9PpsnIOP4ePiOBdf8vpieM4t+bLPfSWsKrkEX8XXwkjJt43zKuf9Y5f2vFviebdkBmYbwxzc grnOv8O91f9Y137IdoHrPoKf41E85XrV+FsX/61jPCzJ+OyeMDI+CtvHF+T/dU1Ij8//lXip 7f6OHxAlxjq7GWr8wY4dgkOhH48/Iv+9ZL7S966rZud/EXRsjfbKe8e/l/8tz7HvUfLrrf5o XOzC8G/xi8OrVqel+e+2vNcXfST20ZCKnYlz8ClcGBpjXwhrYxfhYqvyS8MWq4t2q4v20svD 2tKv4/aQKv0J7sBPcSfuwt3wLFc6H/fgXtyH+/EAHsRDeBgL8Ah+jkfxGBbiF3gcT+CX+BWe xKKQSnw4pKK4kWZjl3smvs4z9HnGnzH+TOzckDT+TOyztneErbGfenb5RnSy/nWyM9eW/nNI lv4LLsO/4T/D1tKpuAbfw7W4AbeHjNgyYsuILSO2jNgyYsuILSO2jNgyYsuILSO2jNgyYsuI LSO2jNgyYsuILSO2jNgyYsuILSO2jNgyYsuILSO2jNgyZV8MW8suwpdwMabgy/gKLglbxZ7h 4TmhhUNvxMZ8DKvHvjk8UuzV4q6OfSMsiV2BabgjrKRB/rdo28ReLfZqsVeLvVrsK8W+Uuwr xb5S7CvFvrL0prCk9GbMwjz8OCwxrpXGtdK4VhrXSuNaaVwrjWulca2MLuBAJQcqja2LA5XG NyKDhmXQsHF2GEmrkbTGL/3rcPzyv2bMLuWcOdXsUs6dU/c+46+SXcOya9joWo2u1ehaja7V 6FqNrpUzlZyp5EwlZyo5U8mZSs5UcqaSM5WcqeRMJWcqOVPJmUrOVHKmkjOVnKnkTCVnKjlT yZlKzlRyppIzlZyp5EwlZyo5U8mZSgq0UqCVAq0UaKVAKwVaKdBKgVbOVEafpUIFFSp4sYYK FfxYE7sw+oDop4h+yt7vW+/c+zx9EhUmUuEMKkykwhl7vyX+Gq/W8GoNr9bwag01plBjCjWm UGMKNaZQYwo1KqhRQY0KalRQo4IaFdSooEYFNSqoUUGNCmpUUKOCGhXUqKBGBTUqqFFBjQpq VFCjghoV1KigRgU1KqhRQY0KalRQo4IaFdSYQo0p1JhCjSnUmEKNKdSYQo0p1KiIiuXCsIgT Ir5XxDeKeIII54hwRnQojVbRZxVtmmnTTIcJNJjg3fvFv0r8q8S/SvyrxN8s/mbxN4u/WfzN 4m82jmbjaDaOZuNoNo5m42g2jmbjaFYrleGpf+h3w9HJsUv0uMtRqc9N1eOuxjVwbSPufK/X zdYzbglry2aFVNkPMRtzcAvmYh5+hCrcih/jNuiNZXpjmd5YpjeW6Y1lemOZ3limN5bpjWV6 Y5m+WKYvlumLZfpimb5Ypi+W6Ytl+uI+41GKMj0v39lTY2PPqPGkGk+q8STd8s/px3t3vdpN qt2k2k2q3aTaTRp7xtgzxp4x9oyxZ4w9Y+wZY88Ye8bYM8aeMfaMsWeMPWPsGWPPGHvG2DPG njH2jLFnjD1j7Bljzxh7xtgzxp4x9oyxZ4w9Y+wZY88Ye75nXR42UfsNCr/8Xs/KR9QRnS6i Gu9v8/4IN97hxjvceMe5Hc4tcW6ZSikV6SkqpVS0p+z9DugvHHqHQ++IskaUNaKsEWWNKGtE WSPKGlHWiLJGlDWirBFljShrRFkjyhpR1oiyRpQ1oqwRZY0oa0RZI8oaUdaIskaUNaKsEWWN KGtEWSPKGlHWiLImOkskVbxZzZvVscroCP6sFsF/qoDdKiArkltFcvDeb2YOzn8zI5KH899m 8W4171bzbjXvVvNutaiqRFUlqipRVYmqSlRVoqoSVZWoqkRVJaoqUVWJqkpUVaKqElWVqKpE VSWqKlFViapKVFWiqhJVlaiqRFUlqipRVYmqSlRVoqoSVZWoqtTx5WN1/DFRvLn3/3OabNT3 G/WyqEy89eKtF2u9uA4S00HeeVA89eKpF0+9eOrFUx8Vxabz9cawOzYjvB27VV7cHfpjD+a/ aXd0NHZryEYF/nd3dKIzsrGbZMTNuDU0xW6LSmK3+/RdoSf2UP63nsOe2CNhT5n1bZn1bdkH 8EEciaMwCUfjCudciavwHXwXlZiKq3ENpuF7+D6uxQ9wHa7HDZiOGzEDN+FmzAx7xuIZNdKu 2OzQLZbtsQfCzpgnvejrsetk+/WY7uhNorwZt4SG2FzMw49wa3RQ7LawNDbfefeEzti9uA/3 Y0F4XnzPl8XCG2VxFGIcilCMEoxHKcqQQDn2wb7YD/tjAg7AgTgIE3EwDsGhOAyHh34a9tOw n4b9NOynYT8N+2nYX3ZuaCg7D+fjE/gkPoVP4wJ8Bp/FP+FzmIzP40J8AVeI40pche/gu6jE VFyNazAN38P3cS1+gOtwPW7AdNyIGbgJN2NmeD4qlDlbqLiBiltjD4VBuXRrGJInI9FXuJDj Qo4DoxzIZ9hWM07WjJN1RpbKOSrnzDBZM0zWDJM1w2TNMFkzTJb6OernqJ+jfo76OernqJ+j fo76OernqJ+jfo76OernqJ+jfo76OernqJ+jfo76OernqJ+jfo76OeqPUn+U+qPUH6X+KPVH qT9K/VGzXNYslzXLZc1yWbNc1iyXNctlzXJZ6uaom6Nujro56uaom6Nujro56uaom6Nujro5 6uaom6Nujro56uaom6Nujro56uaom6NuTs3dKLvztTibpnNk963RPtTuovY2au+MrqVxLY1r ZXqPM1fTuovWXbGZ9meHXp8akvlpmZ+W+WmZn+bDu3yo5UMtHwZjPwuvq4AWFdCiAlpUQIta ekNv+AuPmnjUxKNaHtXyqJZHtTyq5VEtj2p5VMujWh7V8qiWR7U8quVRLY9qeVTLo1oe1fKo lke1PKrlUS2PanlUy6NaHtXyqJZHtTyq5VEtj2p51MWjLh518aiLR1086uJRF4+6VEhahaRV SFqFpFVIWoWkVUhahaRVSFqFpFVIWoWkVUhahaRVSFqFpHlcy+NaHtfyuJbHtTyu5XEtj2t5 3MTjJh438biJx008buJxE4+beNzE4yYeN/G4icdNPG7icROPm3jcxOMmHjfxuInHTTxu4nFT VMnBJAeTHNzF71e4uJNzbZzbwbl+zvVzrp9z/fxP8H8Z99LcS8fudOxuTs8PiznYw8EeDvZw sIeDfRwclCcruNjBxQ4uprmY5mKai2kuprmY5mKSi0kuJrmY5GKSi0kuJrmY5GKSi0kuJrmY 5GKSi0kuJrmY5GKSi0kuJrmY5GKSi0kuJrmY5GKSS/1c6udSP5f6udTPpX4u9XOpn0v9XOrn Uj+X+rnUz6V+LvVzqZ9LaS6luZTmUppLaS6luZTmUppLHVzq4FIHlzq41MGlDi51cKmDSx1c 6uBSB5c6uNTBpQ4udXCpg0sdXOrgUgeXOrjUwaUOLnVEH+VSlkvZsWr8bxeGuTDIhUEOZDmQ f24apO4gdQepO0jdQeoOUjdL3Sx1s9TNUjdL3Sx1s9TNUjdL3Sx1s9TNUjdL3Sx1s9TNUjdL 3Sx1s9TNUjdL3Sx1s9TNUjdLnUHqDFJnkDqD1BmkziB1BqkzGJ2kM7yjM7yj+tPm89LYnaK4 SxRjo/f6ISww3z9i3j7cqu4IfAAfxJE4CpNwNK5wzpW4Ct/Bd2EFSesRWo/QeoTWI7QeofUI rUdoPULrEVqP0HqE1iO0HqH1CK1HaD1C65Hou7TuoXWPEaeNOK0KUqogpQpSqiA1pv/fKoDu /1PmW8HH8t9s/O+zvYcfPfzo4UcPP3r40cOPHn708KOHHz386OFHDz96+NHDjx5+9PCjhx89 /OjhRw8/evjRw48efvTwo4eCaQqmKZimYJqCaQqmKZimYFo1pFRDSjWkVENKNaRUQ0o1pFRD SjWkVENKNaRUQ0o1pFRDSjWkVEPq/6IaUhxKcSjFoRSHUhxKcSjFoRSHUhxKcSjFoRSHUhxK cSjFoRSHUhxKcSjFoRSHUhxKcSg1NscPjP2/kGfzKs2rtG6T1m2StE/TPq9xmsZpGqdpnKZx msZpGqdpnKZxmsZpGqdpnKZxmsZpGqdpnKZxmsZpGqdpnKZxmsZpGqdpnKZxPsa0GNNiTIsx Lca0GNNiTIsxLca0GNNiTIsxLca0GNNiTIsxXZbPhem4ETMg38SYFmM62k8vzvx9zci0O8cq PaunZv9PNWLtfqM1qidT1ZZQbUWqbatKO0illUZT3uso083GszHHc/mt7nVHGJDZA87Oqc0B s/OwT51C4SyFh9+3ahqQ3QOye0B2D8juAdk98P+p2wzIvgHZNyD7BmTfgOwbkH0Dsm/g/+mq KP+0kqPU6+89twxH8b3HclzaE11K2zra1vGvj399tM0/2bRxYhx9u+nbPdb/5tt/wDPCg1ZK Cxx7JHTTtZuu3XTtpms3Xbvp2k3XOrrW0bWOrnV0raNrHV3r6FpH1zq61tG1jq51dK2jax1d 6+haR9c6utbRtY6udXSto2sdXevoWkfXOjnVJ6f65FSfnOqTU31yqk9O9cmpPrp3072b7t10 76Z7N9276d5N9266d9O9m+7ddO+mezfdu+neTfduunfTvZvu3XTvpns33bvp3k337rJ8nNNx I2bgJtyMmaF7TOPdeyshFx0QWx5NjL1sxfmKvHw1zI29Hqpju6wzMmF+bHdoiOuc8ZM9vZ4a lsbPDMn3/lr5smi/+L+O/Zeq8n9T2JPYHNZxbJHrLsErKuDVsDG2Sqa/htfdc7Xt2rA5ts6T 7kZ3a7JtRk80PtarUjPWuFkroRGMhsF4FDrjxSjBoZ7+Tw1d8dPCrvjpOANnhWz8vLAtURHS iStDfeJq6BGJ79teGzYnfgA9ITHLdrbtHFhDJ6pgxkzcDVWZmO/9+x3T+xIP21+Ax1xjUdid eNr1l+L3YVfiD1jmWI39523FlGhwrBHr0WK/FZu9bken8/pCZ2IXRkJn+YGhv/wgTISnw3JP h+XHOj411Jdb05cbV/ntYbj87rCr/EE8gidDf/TFvaq28SlH1Raq9lG1j6rvUHU7VVup2kLV XVRtoWoLNbPUHKLmECWHKDlEySEq7qZihooZKmYo2EfBNgq2ULCFgm0UbKFgKwVbKdhGwdZ/ ULCNgn0U7KNgHwVbKdhGwTYK9lGwj4It1OujXh/1MtTLUK6PYhmKZSiWoVSGUhlK9VFqiFJD lBqi1BClhig1RKkhSg1RaohSLXuVaqNUH6UylMpQKkOpoejo2DNhVmx5+D2lauXgHgr9hio7 YlvCd+TZ9FhveFx2XxYbttLeHT4pz/4Sj4dV8aLws3gifE+2N8UPDJPiR0ZXxY8LN8j8o+On hM9Q7UnZP1nOPRr/ZJgTvyB8Y+9fZ3XE/zU8Eb88TI1XhhX5v18S1Qt60stmiVfxenjLHd/m xxZ3TLpDr6sOuOI2V9ypls5TS5/wRPgMx14OjT6Vr5c3xmqkJ/qgT6/3yTU+ud3YksZW5gob x+rhzLDRJ18Oa3zqbZ961icO8Imt7tcxVr+eqsdq+Eh1erL9U8MWn+o0ylXRB2TWrrFPrpJZ r2G1jFnr0+tk1UaryCbb5rBddmyXHdtlxnaZsVVmbJUVW2XFLlmxS1bskhE5GZGTETkZsVUm 5GRCTiZs59x2zu3iWr7z90T7GE+RkS9yv2fc909ifR6rwyhd2+mZTNwUsq4/5PpDrj+UeMT+ L0LWdYaiQp8aNvLrfGJbPu+thJ/RS5aL5dXQ4OjmWKM+ktdwS0jRrdF1W1y3JbrcXec7e66a 6hrLlj+F2e4+2ycHKTFKiVFX6KJEoMTw3roapsRwrDUsccUamdQQS8ueUhwYroxP5MbBOATH hOvjx+K4sCN+Ap9PxMnco3v8U96/YOxvl08zmtPUXhd1h6k7rPa6KDxM4UDhoPa6qDCb0oES 8ykxnxLz1V8XtUepPUrtUWoH9del/rqoPkr1UWrNpvwwxWYnFutES/BiuD6xyvYN1GMdNqEN b3mvw3ara2wL15dH4S/l48KS8iIUY5L94zFVh5oX5qvBLm6Olj8UtpU/jAX4ORaGJVGZjByS jds4fYbu867u867u8y7Xz1Hp76r0d1X6u6r63egIfuS9zNJ+gPYDPlWkRw3qUYN61KDYh8U+ LPZhcQ+Ie0DcA2IdEOuA/jKovwzqLYN6y6DeMii/B/WWQWMdNs4BvWJQrxjUKwYLSt1xngx4 iPsruX8f9++LreBoLV4Or8dWmRVfw+vhSVmwJ7be8Y1yqzVMj20Kf461YTPa8Ra2hNtjHbbb 0OWa222T6EZPNE+21MRSXu9AWub12fZjZ7g+NoBBr4ewK1TqTQ06d6vO3aqCL9Oj1sX2eO8d vBtWxP5qG8zCBYgh378KZds4r4v0qdIwN17mdSJMG+tn+9ruh/0xAQeG82TrhbL1Qtl6obn1 tvhhYUb8cO8dgSOjr8Un2R6NY/S8Y3Fc+Lf48fY/hBPsn4iTvP4ITg6f1SP/XWdZzLV5XJvH tXmy/WL98u742c45Bx8LP4p/3PZcnBduiZ9v+wl8MnxTVVwY/7TXF4TrVMZle/9idrEKmRH/ enRI/FuoDG/qr79LVIaGxFRcG/aokj0q5D4VskeWzJMl82TJvMQ87/8IP8Ed+CnuiiYm7sbP MN/5Dzr2EB62vwCPuM6j9n9h+3iYlvglnsSicFvi12GG2eyWxDP2f4vfYXGYrKomm+FukYHz ZOA864PbzHK3JP4YfpRYjmed97xjLzrvz16vQK3jq+y/7vhq161zbC3ecKwe69DgWo1Yjw3O b3FuKzZ5rw26t+yep2onJ7aEP6vcyWbRW1Tvhap3cqLLMTmYkIOJtyEPEz3oDSsT8jAhDxNp yMHETgxgUAcYQtbrXFiR2I1Rr9+FnEvIOV1hbrm8K5d35fGworzQdlyYrktM1yWml5fYH697 lEIOlifCyvJy7OP1vtjP8f0xAQc4fmBoNdO3mulbyw92vUOccygOw+E4Ah9w7pHePwqT3P9o x3RY3Whu+S2hQYXPK789mljO63Jel/O6/E7chbu9d3+YofLn6VSTdarJOtVkXWCebjW5/FHX WWjcj7vmk66/yP6v8Rs8Fa6PJukS1+kSfxibmV8Zm89f0wm6Vfx8lf1Nlb1c1S5VtWvMuRkV +5KK7VKVjaqxThWuUIUbVN3nVNa3VNJSFXO3inlNxXSrkgdVyQZVUCv7fy37vyz7V8r+/L9U OFvGvxn9h371tJH8zoy1PrbULLVcT/iTY8/jFfPcq95bFZp1z2Yz10o9q8/Mtdwc2Ge0vWav 5Wav5frXIiN/TZ/qNfJ1etEqo27Vb7bpN9uMvFu/3mjkO/XsjXr2Rv1kldEv1gsW6wWLjXKP UX41v+Yxe61P/LtOe2VYbgZbbgZbbwZbrjb71GafGWy9+nxaffapz6fV59Pq82kz2PrErT73 Y9yJu0Kzrt6sqzerzT6z2Xqz2XodvlmHb1abT5vNlqvNp9XSYnm/WJ4vltO95pON5pON8rbX nLJRrvbK01XycpG8XCQvF8nFXrm2Ta5tk2vb5Fav3OqVV9vk1TZ5tcpctFFOrTLDLZdTT5vh 1ps5muXHIvnRKz+2WUGukAe1eNkK7fXwJ0pvNzs0yoXP6Obtunm7fFhL1U6qNlC1QU48p3Nv oexqnbqdsqspu1pu7JAbb+vGG3TjDbrxBjnyETkyosu26bJtcmWTPEnqrPU6a73OWi9nmnTT Tbpoq865QUds1BEbqb6d6tupvV0HbNQBG3XARh2wUQdspOx2Xa9R12vU6Rp1tFZdrE0Xa9PF WnWxel2sXgdr1cE26WCbdKtNulWb7tSmO7XpTm26U73uVK871etOm3SlNl2pbW9XqteN2nSj Vt1oA3dW6yztOks7l1ZzaLXuskV32aKDbNEt2nWLdp2hXWdo1xnaOdXAqQZONegKW3SAdk41 cKpB5bdzarXKb1TxjSq+UcU3qvhGFd+o4utVe71qb1Ptbaq9TbXXq/Y21d7OxQZV3q7K21V5 uypv90zcY3WcX1efGd6JzlJl+eesq1XUAhW1QEW9wue5qmY3X3/D1xq+1qiWFF+7+LqEp0t4 ukRF5FRBjhdzeTFXBeT4MVfG52T5Alm+QJYv4MVcWZ6T5TlZvkCWL5DNu+m1hE5LZPNuWi2h VRetumT1bnp1yeTd9KmhTw19aujTJZt3y+bdNKqhUQ19lsjenOxdIHN3i7lGjK+Gu2XsiAhW 2Ntl7JnwjNzcEh0msl32kiLrFVmvyAZEVa8PpERWL7J6o9tldPVGV290u4yu3qh2GdEuI+o1 ol4j6jWaXUazy2h6jabXaOqNIv8s2xsd6U4Zd9rkTkl3SrpTDw3zz6gN7jbsbg3u1uBuGXdr cLcGd8u4WwMthmgx5K4ZWgy5c8adk+6cdOckLYbcPePuGXdPunvS3RvcPf98mPSMsEW/3BXe FPWb7jzsju162fM6bouOm38+eG6s4xY5a3jvM1Rq779hOjV+eXT6mHKd3mn3TufYXv7Zbs+Y juP2fmrIXtr1m11/0Gq41Zo2TeFRcZZSIsI4a9IiFGOS/eOxMAy4xpYxZxqdvdkskh/jcHS8 a7zmnT/Rb8i1XnDG2397vh+bbyL9pRglKA0viOoS0fwnHYfouIWOW+iYf77eQr8hY3jBGF4z hteM4TVa/v1z9+E44n3P35Ocf6xaPN52ofMfdyz/zF0g5v7oYOMbNKZBY9phTDv2foOz0+h7 jWunce00jp3GsdMYdrr3oHsPuveg++5w3x3uu8P9drjfDvfa6T6D7rEjOtbVXxT9X0S++n1d diOdF7tTdqyrlo79pciP93q5SfSV+b/o+Vv3EfFqd33RXV901xf/l50n32kmOS/fZY63zXeM hc79x44xfmwW3WUdsNuzdRFfLw3X7v3rjjfd+WtjfzF6unFvceZzXKv3XNBs/C9Raen7Okh+ Zmil1EJe5+fdt6m1kFoLxfOSq97paku4WG/t1kzBhRRcyMl6Ki5UEa0qopWj9eJ7SVW0inGL GLeIcQtX663Bmq3Bmq23mv+hc7RyuZ7L9e91jkmucWxYKPaXxL2Fy/Vj3eNwqm+m+uaxbyMy usju8KpR91F+sxH3GXH+O5w+am+m9maj7DPCPipvpvJmKm+m8mYqb6byZgpvdqc+Cm+m7mbq bqbuZupuVlUZXXfU7Cd7ZFgmvBTFzIKjVkq7o7jVyOv2Bu11R5Ps9XuGyVmf9Fuf9JspR8yU I2bKkb3fEaasWQas43NmvJSZLmWmGzHTjViv58x2KWv0nHVFvzV5zuw2YnYbMbuNWHfnrLtz ZrYRM9uIdUe/mS1l7dFvphkx04yYXUai8eby3UbymLm735ydX9e97a79HHySg0+OdZXxZvvh +IE6yckhLYJeZ6XjZ0X76jCeeaLT3Kc1KnSd7a6T/841l49AxImxbxBS+fMpcaB6OivkHM9/ K+sMn9sWHWQvH/2w6IdFPzwW+detFb4Vmt4X+bDIh8eibrBtxHpsRjtEJ7JhkQ2LbDg6yt3W 0TdD3xb6trz/ydy90+6SpG3GHZLukHzvaXzZ2Dd+SdpmaNtC28zfPaG32G8d+xZw7Emdti3u nqRty/uf1qMCkWeiY+PlXh0YHrda6rda6rda6jemZ43pWWplrJh6rZjy36710WmHlVE/B97h wG858FvPkRM8R+b/OjK/6um16uk1rmetbnqtbnqtbnqtbnqtZnqtZnqN51krmV6rmH5jetaK oteKoteKotdqojcqNpo/uPMud8y54y532+1ua91tbXSMd7fSrdsYNxnjJmdm936H/T8cOsvK 7jx5fQEdFoVuGo7ScPQ9l5Y5VmP/edsXrbRet32/ay32W/E3995yTqfzt4VNf+fiRKp1Uq2T ap2U6qRUp3F37P1OqpMinRTppEYnNTqp0UmNTmp0UqOTEp2U6KRCJxU6qdBJhc7oMHG+Jca3 xPiWGHeKcaMYN4hxgxg3WKnms26DeDZYVaasKlNiecvKMp+BG8SyQSwbrCRT4tggjg3ieEsM b4lhgxg2iGHD2L+iPCb+7eiYaEF0RXgkuhJX4frwRDQz3BvNwg8xG3PQFRZE25HEkHN2h3ui UezBO3g33FNwQmgoOBEn4cP4CE7GKTgVH8VpOB1n4EychbNxDj6Gj+NcnIfz8Ql8Ep/Cp3EB PoPP4p/wOUzG53EhvoAv4iJ8CRdjCr6MyujggpXhpYKXw3MFr+BVrMJreD2sKFiNNajD2rCi 8PFwb+ET+CXq7a/DmxBr4V8Rwj3j9guPjJsQFoyzyh5nlT3OKnvcwTgEh6Iz3Dsu7Zw+DIR7 i07E2bgmPFI0Dd/D9zE9PFF0I+heND80FDWEFUWeeIqPDyuKP4QTwnPFJ+J0nGH/fHw9LCj+ Br4V7il+GIvQaX8rtoFnxb3hieIUdnpv2H423FMSCw0lcRRiHIpgpVhipVgyHqUoQwLl2Af7 Yj/sjwk4AB8PK0rOxbe9vsp2ru1TttXhuZJMaBjvWuMPsD7+ZjQhrIsOgO4XHYSJOBgfwgk4 ESfhw7gIX8LFmIIv4yu4BF/FP+MyfA1XhMdk7mMy9zGZOye6ISyMpuNGzMBNmBmqZXO1bK6W zdWyubrwp2Fd4Z24C3fjZ5iPe3Av7sP9eAAP4iE87nNP4JehmuuPjWsJ68a14y10oNPxt227 kfZ+HwYcezesKypCMcajFIfgUByH40GHIjrIjuqiM23Ptj3P9vP4Jr6Fb6MC14THZM5jMucx mfOYzJkjc+YUibdIvDKouuT7eW2ie0NDdB/uxwN4EA/hN3gK1Xgaz6AOa/EG6rEOb6IBjViP DdiIJrSiKyzTE5bpCcv0hDXRLgwjgyxGsDss1SeW6hNL9Yml+sTSwp7QUNiLFHYgDU8nhf3Y iQEMYgieWAqHkf/cXxHCUvW2rFgvKFb7xWq9WK0Xq/PiKWFN8b/YXoqvO+cb+FZYWny1/Rsw HTNwE36I23A71FsxjYppVEyjYhqpp6XFv7JdZLvU9kXQoZgOxXQopoNaW6bWlqm1ZWptmVpb o9bWFO9AGjt9dthxeqi7pQWnRIXR/tE4FKEYJRif/w/E5P9zEEiM/bd694/2wbnRxOg8XBFm yfFZcnyWHJ8ux6fK8alyfKocnyrHp0Y3u8LMME2eT5Pn0+T5NHk+LaqK9o1uxY9xG27HT3AH foo7cReejz4YvYCuMJOjMzk6k6MPcLSao9UcreZoNUero/wvSO8Os7k6m6uzuTqbq7MLfh6a Ch7FY/gFHscT+CV+hSexCL/Gb/AUqvE0nsFv8TssxhIsxe/xByxDDf4YmmIfjfaNnRZNjJ1p +ylcGGbFvhCuj12ES+xXhnmxqeGa2NW4JlxjzXZR/BvhBuu2i+Lftr0h1MWnh8Z4QzQu3hgd GN9g1dvkqbw5Ko13her4dmuRZHRC/G3b7vxvA9nuiCYU3hDtXzgdN2IGbsLNmIlZ+CFmYw5u weNhmn4xTb+YVrg+2rdwAzaiCc1oQSs2oQ2b0Y63QE/ZPlu2z9ZrZo3bPzTJ+pl6zLRxO6JS /WWW/jJLf5k2bk+0f1EccqtoAg7AMTgxTCs6yfY0nBFN1FOmFZ3j9TVhlv4xS/+YpX/M0j+m 6x/T9Y+p+sfUIrlUNBNyqeiR0FT087F/Qd9U/AF8EEfiKJyGKaFapc1UaTNV2uziH0T7Fl+H uZiHe/Gw4/9F3JmASVFd7f9W3eq61dXVwzYM+765xLjEaCTqGDOaqIASRREQMGAQBWRXdncQ lFUBRUFlccEgihuLuBBcEgWBBpqGQWCAGZqhBhBmgBn6/n9VjPk04qfJl+f5Tz9vV9Wtu5x7 69xz3rfF7jkcXxAN2U2j1ELOd1B/J9gF8Dl2zpPsnCfZOS+zc15WB0RU+aCE+ke4j/+xg0ap MlHFydYbnZogB9QCtUEdUBfUA/UBtjrY6mCrg61OE9AUNAPNQQvQg756gjvAKK5HgzF6Y9TQ G92OepDbCYzSfdwxgH3jsm9c9o3LvnHZNy77xn0CTASTwGTAfN2pYBp4EjwFpoMZYCZ4GjwD ZoFnwXNgNmB93OfBC+BFMBfME1ViI8BIMAqMBmMAaxtjbWMPAvZ3jP0dY3/H2N8x7IxhZww7 Y9gZw84YdsawM4adMeyMYWcMG2PYGMPGGDbGsDGGjTFsjGGjd7aokhUFLogFv0gv17JTCohG wVnw3SO1zHuJZl746wI2UMABUeAGvzsU/vpQ8A32XvATITCAFAwgBQNIwQBSMIAUDCAFA0jB AFIwgBQMIAUDSBH5ahD5asAE0jCBNEwgDRNIwwTSMIE0TCANE0jDBNIwgTRMIE2U7EWU7EWU 7CXu1L7oDe4Cd4M+oC/oB+4B/cEAMBAM0r2JqP2JqP2JqP2JqP2JqP2JpnlE0zyiaR7RNI9o mkc0dYmmLtHUJZq6RFOXaOoSTV2iqUs0dYmmLnl3G3l3G3l3G3l3G3l3G3l3G3l3mwg+73gZ vAJeBUtFHSJvHfKvT/71yb8++dcn//rkX5/865N/ffKvT/71yb8++dcn//pE6wFE6wFE6wGi EC1bBPaBNNgPisEB4IMScBAcAof1DCL7AiL7AiL7AiL7AiL7AqL6MKL6MKL6MKL6MKL6MDh9 Ek6fhNMn4fRJOH0STp+E0yfh9Ek4fRJOn4TTJ+H0STh9Ek6fhNMn4fRJOH0STp+E0yfh9Ek4 fRJOn4TTJ+H0STh9Ek6fhNMn4fRJOH0STp+E0yfh9Ek4fRJOn4TTJ+H0STh9Ek6fhNMn4fRJ 4waRY7QHfwI3gpvAMzpBJkqQiRJkogSZKEEmSpCJEmSiBJkoQSZKkIkSZKIEmShBJkqQiRJk ogSZKEEmSpCJEmSiBJkoQSZKkIkSZKIEmShBJkqgJZagJVagJVagJVagJVagJVagJZagJZag JZagJZagJZYYXwjX+BKsAWuFSxbzyGIeWcwzWwf/jyrH33P8ox5DNmtHNmsXZrPOutjsCXqT 3b6T1cy+upjMdhmZ7S4y22VktrvQ4pPkIP1XuVx/LFeKLPkR2W8ten4dOn2DqEWWS5PlpNyM vj+V6SJkuubhd0ymKd9P5hksPLKcR5bzyHIeWc4jy3lkOY8s55HlPLKcR5bzyHIeTDoNk07D pNMw6TRMOg2TTsOk0zDpNEw6DZNOw6TTMOk0TDptzdC+NRM8DZ4Bs8Cz4DkwG8zReWTOPDJn HrprCbprCbprCVnUJYu6ZFGXLOqSRV2yqEsWdcmiLlnUJYu6ZFGXLOrCM314pg/P9OGZPjzT h2f68EwfnunDM314pg/P9OGZPjzTt47qYqsUlIFj4Dg4AcpBBWBPkJmHkZmHkZl7kZkTZOYB 6L8k+i+J/kui/5LovyT6L4lKSKESUqiENCohRQbPi+zWPkohhVJIkcl7kcl7RbApgk1k9Dwy uodqSEUyXGvt2wIYwARSeGR6D0WRQlGkUBQpFEWKzO+R+T2URQplkbLrU7cBaEZZC65bAmIt KiMFM8iDGXj2edzHB2EHNVAdKRhCHgzBQ3mkUB4plEcK5ZFCeaRQHimYQy+YQy+YQy+YQy+b OGoTR23iqD0IDAZDdG/YRG/YRH/YRH9YRB56NgmTSMAkEvbs8BuZcuzF4K3wW5ly7NUcv9JL YBkJm2eJ7k3aZSIHxpGAcSRgHAkYRwItvAQtvAQtvAItvAIGkkAPr0APL1G/FS6aeAm6wEcX +OgCH13gowu2wVIWoAt8dIEPWxkAWxmguuhidRvoqoehD3zVh3P2lOoH7gH9wQD6HAiYF9ph G9rBRzv4aAcfhuPCcFw0hI+G8NV46k8Iv1XQh/W46AkfPeGjJ3z0hA8LGgYLcmFBddAVPkxo GEzIRVv4aAsfbeGjLXy0hY+28GFIA2BIA2BIA2BIA9Ru+t4D9gJivSLWw5pmwJpmwJoWwJoW wJaGwZYGwJYWwJaGwZZctH4SrZ9E6yfR+km0fhKtn0TrJ9H6SbR+Eq2fROsn0fpJtH4SrZ9E 6yfR+km0fhKtn4R1JWBdCVhXAtaVgHUlYF0JWFcC1pWAdSVgXQlYVwLWlYB1JWBdCVhXAtaV gHUlYF0J5wJs+hW4RC9xWoNu9N2D657gDvAXynpxvBP0BneBe3QahpaAoSVgaAnnftpMovwl 6r6sVzivcP4qOKqTUSFyYHCJKHOL1tBLojWF696oC9ybwM2go24Hs2vnduH8Pl3sDgMjwLdM 7wHOHwFjhQfj82B8HozPg/F5MD4PxufB+DwYnwfj82B8HozPg/F5MD4PxufB+DwYnwfj82B8 HozPg/F5MD4PxufB+DwYnwfj82B8HozPg/F5MD7v/yPj877H+GqKifpSo6toa3QXNxq3i/uM P4urjB7iUqOnuMX8o+ho9hY3yw76StlR/04u0wvkSt1W7tKfww2zJRFO7tVTZJH+VO4T9WQa vbVfl4pGYmJmlVio14u/6fX0fnnlt8FeRO9n0/vZ9H6F0VuXklv3MApqDlXWQbdmlMsYZYhc oZfL98HKTLH8UL9NjtssP9ar5So9kdEfZuRjco8uZPTWjD6J0SWjz2b0VcKRa/Q8+RU2oeTl et1DbtBLZYJWm/RWsmI+PHWh/gTbPqHmreTONdSeQe0Rcn0mQ+0XqH0NefRtWtxLi2fC73Y8 F2tHkc0bkL2vMduSyXvr3mY/Ic1X4cmr9J/NT/VMc7v4tXmUjJwtqshz9Xy5Qnhk6XOZwRuM 9Cl6VMr1aM2N+i2ydITeM8woQaYeUZmpZaUmlcysUO5jVmnK9+sDxi3C0ktFBNhAAQdEgQti wANxkAWq6OWiKmitt4rfgof0YvEweAQ8CsaCceAxMB5MAI+DiazhUr1OLNPrDFNvNSSwQATY QAEHRIELYiAOqoJqoDqoAbJBTZADaoHaoA5oCBqBxqAJaAqageagBWgJWoEbdL7RHvwJ3Ahu AqPAaDAG3A8eAA+Ch8DD4BHwKBgLxoHJeosxBUwF08CT4CkwHczQW8zz9GLzQpAL2uv3zMd0 yhyvU3h5B55KMX5WgY8t5kkU42PX42MVsjRTJMvYEce0ksczZfJEZqss17asyBTKkzpXZijX uo4VyRRZtr7SUlpZTqbMima2Wq62rVim0PJ0rhWnPIt6g/VSawgYCu4F94FhYDgYAUaCUWA0 GANe1FutuWAemA8WgJfAy+AV8CpYCF4DfwWLwOtgMXgDvAmWgLfA2+A9nW8tBcvAcrACvA9W gg/Ah+Aj8DFYBf4G1uvF1gaQABvBJrAZJMEWkAJbwTaQrxdHyvVSWwL8147o5XZ1jjVAM3AW OB/8Sm+1L+b4uM63p4OZXDNPez7nzMdmPjbzsZmP/Tpli8GbYAl4FyylfBlYDlYAbLex3f47 5/8AX3D+JVgD1oJNYLPeYqe4Vwj2g0PgMPgGHAFHQZnOV1mgCqgKqoHaeouqA+qCeqA+uFBv VReDAXqxGgjuBw+AKWAOeEGvUws5lunFTiud75yttzq/5Hgex3bges5v1VucHtzvCe4Aj1E+ k/KnwTNgFlgIyvWWqND50Woc2V9R9lW0Lqivt7o9dMq9C/QB/UB/MBiw3132u8t+d9nvLvvd Zb+7T4CJYBKYDLDXnQqmgSfBU2A6mAFmgqfBM2AWeBY8B2YD5ug+D14AL4K5YJ5eHLtWp2LX gTagLWgHrgc3gPZghH4vNhKMAqPBGHA/eAA8CB4CD4NHwKNgLBgHHgPjwQTwOHgCTASTwGQw FUwDT4KnwHQwA8wET+v3vLP14qyofi/LBTH9nrDIFYuJ/Gm5UfySuFwhnhLD9SwxAowEo8Bo cFyn0M8p9HMK/ZxCP6fQzz762Uc/++hnH/3so5999LOPfvbRzz762Uc/++hnH/3so5999LOP fvbRzz762Uc/++hnH/3so5999LOPfvbRzz762Uc/++hnH/3so5999LOPfvbRzz762Uc/++hn H/3so5999LOPfvaDb+EyPsHOT3UxmrUYzVqMZi1GsxajQ2eiQ2eiOzegOzegOzeY83RR+O8j T/2ro51mmd5JNkuSxWbJtaIR+XIHGexxNNwsNNwsNNwsNFwxGq4YDRfopxT6KYV+SqGZfDST j2by0Uw+mslHM/lopFnooFnolFloklloiFloCB+NUIw28NEBxeiAYnWWTqmzw+/jLIb7B1w+ Bc9Owa1TcOEUHDgF//Xhvz7814f/+vBfH/7rw399+K8P//Xhvz7814f/+vBfH/7rw399+K8P //Xhvz58tRi+Wgxf9eGoxc4Q+r6f85eCb03TPnzTh28WR7PZTx31TDjmTDjlBjjlBm+ULvJG gzG6KJ6td8ZrghzQCDQGD1A+V+8UJlnlNfI6PE4uE5fI5eI2+YG4UH4oarO+78qPYVKrRCu5 RrRjrduh6yMwhsvR9tVlQlzAun8Nc2gIz9lFaYE4C77QDr7QUhaJq+n348rPss9mpI/0QupP C8dczL27YBXLRRZln3O1Nvheyh9+l67RW+Se/vt0sed8dseljNqGfHgNNpwqOZ9sWUbplWTL 5WTLdPgdxfuDX6OktD5Xl4efKdaibgtsCH6LYK84hxq/5GqtyGWG2dxryFyDb33rqL+Ug0Vr 7P/Yugy+ZlLyGVf/oDa5CU5YwlU+V31EnKsTXH0mWglL5IoIsIECDogCF8SAB+IgixE7iJqy ExyvK+jDnJbDAz+EZ36k11mDRa41BAwF94L7wDAwHIwAI8EoMBqMEblo+Vw0ey6aPReNnotG z0WT56K/c9Heuejt3PD3L+Kw2yOMlM8s9soPeJLBr5l8pN+B3e5n7oNZk2XY9T61mC1zj4vq xleimbFOnMfKdGUdfi87Uauz6Cy7ht8x11n20R8F30okh+pdcrq4SM4QFzOOz5NuAZNZZF0i LrBai/NYrc6iIS0aMs6FPM3BojEjHQjGD0eKV/6uyaeyC61vo353jrdzHIyHfaW3wJGL4cfH Q//ZJBxaSWEHv4RC7Rxq5lAzSk2fGiUiRxQQReFQYg+8aSAjBc90qN4A7y7mqVch4q4L+0vw BDfSij4DRhyprivQ8BVo+Ao0cgUauQKNXIFGrkD7VjBmB10U/B9P9HgWO0WFvW3UR0St743Z hZjVHfRlboNh4mv1IawrYR4+HleTsY/SajXjxhj32E+OG2PcXcFvs9BbdcaN0ONReiymxyP0 GKW3Q5WzqGCfdaA0+L7ALjD57mAgdwaLOrSMYrFNy1JaVtAyji2ZYNVoWc6uKBB/ELvBHnAc zz4BykEFOEl06IBy6ajPk12IFreJbrI7x9s59kX7DMSeoXquHIlfTBe/wR8uZcW/YsTW4bNZ r58LR0voTey5bFTOiUofucCibysDtGgVqS7+oDqBzqCraKVmgHlgB9c7wS6AnaqEsiMcS7Et +P7HEiw7zpyPY9lZzPs4lp3FvOsy7yBiOMzXZa6FcrOoGnrdClp8TIvdtKhLi920qEuL31C7 KjbvDT1vvS7H7mO03B22SoS/S9CJ8TrjyV05duM4hKi4SzQl4pUQY1wiYx0iYzXi3YrwF3WC 55eilqSkhOfQgbOO4d4Ivg0vRw7Cq+4l3+3F7iJG3Kf90N920G437Vx6d+jZ5E5K1BE99SFx B/gLGMTT78Dz7IRdXcEQPDOoXYCX7GWlC7FpH/oyTS/7yZOXiVqRqvpQpBgc0IfsPqAv6Afu AUPAUPrNqvxNoCQ9p+g5JQcxqyHE/F08xwK8aDc7KJwtcbiINdqnvwi1eC3sK8e+cuwrr5x9 8JnydnrZTi8mvZyFjVXppYxeMvQSfNO8Qw87g98jwr5y7CvHvnLsK8e+cuwrx75ycY7oKdqI O8BfwHCRJ0aAkWAUGC3yGLEKI/6CmBVhhdsTsyKscnti1kus9Jus9Pv46af46TX4aRv5qp7C nP5Bhmh5yhryVmBNEWziEtEaH21tXaaT1hyRZz0PXhB5kaqiTWQHx2KOB8BBkWefCS4CfUQb uy/oB+4BgX0OVpVW+o1Z6Tdm+KyCFdynC8NPIxZh94LKWjmVtXKw26fmBeEnEPv0BjyjT2YV WvAA2m8HWu8A2m6HdUZmD77WJ+NTWkJJiXWGvpxe+2S2y1LWuZzWFcSGk3qNFdFl6MJjVkwf oeYaal4dtv2Iu+soWUeJG7b15QnGK2dVTuqNaMyMFRU2bTPU2oiWzFAzl7jUJ7OXUTKo1CNY ViyPcyxn1Ao881TLCkbNoE6PYHGx5XB0sSJG+ameKpjBUbyuD7q2TBj0UkIvGXrR9FAUjm0L g9YltM7QWtOyqNKGM4N1ykzGhl20bkbrrbQulSfYsYH1FfjxSTwuA0/Q+iS27KK3ZvS2ld5K rahOhLOK8Zw9URWlnKbnk9j01yCLapMej2FHvswIk1bHGDvfinN+hm4S1MispUYh4wUrlaJG IX0Gq5Sij4Os7r88L55+5XOi9U88n7Bu+Fyo+xPPgzn+H58D8fTfXH+izH953Znjj6x3eOe0 6yyyrGwRtWpiX23hWnXprR5t6sMZGnDekHuNuNeUe825bsG9ltxrRT6wrBxGqMfdxhxb8Ew8 K5srNIRVi/HrMkI9Rgr6akh5I8qbUN6c8haU0w9PIagdjFyvskYwUtBXdewyubvHyqGkFqgt GmJfdWruoc+G2Gdin0mrPVZj7jcBTSlvTp0WlLXkvFXwq+T0ko+twQxNqw621hWRyl6C1vnY H8zQtJpxrzn3TrU2mW82qInv5WBzbfqty1zq8fTrM1aDYF7cb8T9xtxvyv3mlLXgfkvut2J+ zIJnU5N+cyitBWrrTdiQYXV2WfV5lg2Yc0PqNKJOY+43AU2p04w6zanTkjqtyGzBc/LCda0t srEjWLFj2JGNHTHs8MK1bcp183AFj2FDNjbEgqciZDj3upXrfMr6YPVkOO9TLUoqrTZFlf/U J9i1Puv3L37Bbj9XxP9d36DVeUL9mH9wt4Wo8d/yEXr7BbP+D/2E1meIav9XX6GXS4IZ/Xf8 hSfx9/A5/kc+E+aG+L/rN2FUP0OWZvYRSbsTceoT1drKE5kSotpVsiKTJvr0JKo1Jqq1tiKZ fUTU7kSj+kS1tlY0U0JUu8qKZdJEpp5EtcZEtdZWdqaUFTmHFTmTFTnTqs11Hf0LViQLq85n VVqyKi2shpQ3ol5j6jQBTbluRr3m1GtBvZbUa4XXRFFuHporVwa/67NK1IDtZsN0m8MqfgNX WA3bqxL+ttAyo6v4rdFdXG3cLiYYf+bYA+XeQT8rb0aL3KKXwTyeDX+p7sz/pdbqsFbwG0ib w9Jvrxb/88pEya80PtSLw7Pg1+12cVYFlXyOEKI1mvQs8Tte54nrxI3ifHGzuIXSW+Fyl4o7 xePiWjFRvCruEcvESq4+5DVF/F1sElNFktcckY86eV4U0uMrRj2jnlhvNDTOERuMNkZbUWBc b9wk9hidjC5iv9HN6CZ843ajpygx+hj9xDfGEGOmKDWe4VXXeJZXPWM2r/rGK8arRgPjQ2Ot 0cg8z7zAONe80LzYuMBsbbY2LjIvN3ONi83fm3nGJebV5tXGb80/mtcZl5ptzbbGFWZ780bj d+bNZkcjz+xsdjb+YHYzuxl/NHuadxjXmL3MXsZ1Zm+zn9HGHGgONf5k3meONW4xHzOfMHqZ k8zpRh9zpvm0MdicZ75hDDWXmKuNh81PzU3GDDNpFhgvmfvM/cYSs8Q8aLxjHjbLjPfM42a5 sdLUUhgfSVNKY5VUMm6sllVkdeMLmS2zja9kjqxrrJNNZFNjk2wuWxhJ2UqeaaTkL+Q5Rr48 V55rfC3PlxcYO+SF8iJjl2wtf2vskZfJy41CeYW8wtgnr5RXGmmZJ/OM/bKtvN4oljfJjkaJ 7CR7GEdkH9nXyMiB8l5TyJFypGnL0XK0qeR0OcN05CK5yHTlW/ItMybfle+anlwqV5lxuUZu NmvLXXK/2VSWSm3+wopYWeZFVrZ1hnmFdZl1mdnBGmyNNW+2xltvm3dZ71krzenWl9Za8zlr vbXHfN4qsrT5VsSNuOYXES/imV9Gqkaqm2siGyJbzHWRbZEdZjJSECkw8yN7I3vN7ZGiyD7z 68j+yEFzZ+Rw5LBZGDkaKTOLIscjx839kfJIuVkcOWlHzAO2srPMUruqXdXM2NXtmqa2a9sN pbSb2L+Srv1r+9eygX2x/QfZ0L7e7iDPtW+zH5QX2Q/bj8ou9mP2BNnNnmRPkn+2p9hTZQ/7 KfspeYc9w35W/sV+3n5e9rHn2nNlX3u+PV/2sxfaS+Q99jv2Cnmf/YH9sRxjf2J/Kh+yP7c3 ykfszXZSTrVTdko+aW+3v5ZP2YV2Ws6wD9kVcpYSypQvKaUay1dVS3Wh/Ju6RF0mN6gr1BUy qX6v/iC3qGtVO7ldtVftZYG6Sd0kd6ub1c1yj+qkusm9qofqKYtVb9Vb+upudZ8sUcPVaHlS 3a8esEz1qBprWWq8mmDZapKaaTnqGfWMVV09q561aqjZao6VreapeVaOWqiWW7XUKvW5dYZa pzZZ56qt6rD1a3VEnbDaqgqlrZuclk5Lq6NzhnOWdavzS+dcq4tzoXOh1dW5xGltdXMudS6z bneucK6wejh/dK61ejptnDZWL6edc711p3Oj08G6y7nVudXq6/Rweln9nHucAdYgZ7gz3Brq jHJGWfc69zsPWvc5Y53HrBHOBOdxa7QzyZlk3e9MdaZaDzjTnVnWg85LzsvWOGehs9Aa7yxy FlkTnMPON9bjzlHnqDXROeYcsyZFCXzW5KgVtaypURV1rWlRL1rLmhGtE61jzY3Wiza05kUb RxtbL7s3up2sV9zubnfrDben29N6073T7W0tce9277bedvu6/ax33P5uf+s9d6g71FrqDneH W8vcke4Ya7k71n3N+sD90P3M2uNudLdZvrvd3WOVusdjda1MrFlscqRxbGrshcjE2DuxlZHZ sbWxw5GXPOXVjvzDO9u7KpLvdfTujBzz7vb621FvoDfYruIN9e6zq3vDveF2TW+k94id443z JtqNvcneZLuVN9V70j7Dm+49b5/tvei9aF/kzfNesy/2Xvfesq/w3vWW21d773vv29d5H3gf 2G28j7zP7LbeF956u4OX8BJ2F2+Tl7Rv81Le13Z3b6d30P6L9413zB7qnfAq7JFeJi7sMXEz btoPxq24bT8Ud+Jx+9F41XiO/Xi8dry2PS1eN17ffjLeMN7cnhFvGW9pz46PiY+x58QfiD9i Px8fF3/Cnh+fEp9mL4w/FZ9uL4o/HX/aXhyfFZ9lvxF/Lv6C/WZ8bvwl+90sMyvLXpFVPauW /XlWvawG9tqssqwT9nphuvB3Ibwrq90gzhCNxX/pTy/TBXqvOE8Xcb71tDUyepZ+nVeJHs/V DbozbVZzVlR5v0ined9ZeVX6g/bB3bQ+wut/7qnTjPMNePIn7R0B3v9eyXZGyAlG+dE/lBf1 tuhyzj0yeRcR57rg+zZ+O5vTjPmF3qF9/SU97GK2hT9l48/4c+h1emXvu3WxXq33VF4d/sHo +0G+/lpv0Mf0tSLK2p0lmnznfuanBtNHeXZH6OF/LGf9YSyn7s7X84UH/vkM/6X1AbBHp+hj O5cReFZLcTlnjcK7f9Nr9Cb8B99Bt59+/Ff1i3o2x3EgV/9SD9GDOfvOOn47e86Kf9A6oz/R hXjQJ/of2MFzCFbv+63+WfeLn1gKgU4VIis8m1hZ4tP3l9/65ne9orLkCDM/zNpv1d/A96tQ dCFP4Z+j6/3hE9r/be0ftC/W+9hj/rcrHnwyGh63fbfOT9ldWS/1vasB37v67Of1wd/5Yf1K T9ObeX6O3vwTI5d9Z2+fL37zE7Vf0y8HO1p/8rNt+n77vYF3BD77gzsbf0ZrZqYfDc/e+df9 rP/8M9rjI/qtMG5tD57bv/unXwmj6Sus6w//nJ/VQ4leFkbNn+kXp+nh8M/3qtO0roywev1/ 1Hpx+L45iBz/9b9f/Yzx957KZbocP/rm3x7B+1/vtgJ/Ckf5NuPtPPWqvN/oNG3O5NWI15nf s3JB5XHtqdf/0v7807avXF285CjR6eiPGUz8PKAPEcF2hHsq8OpjYfm08HZD/aFeqRNBRv+R 9hXfOZ8g6hD/bxHXBzuksiyf3LD8h7H4n23Kv3M+mcxTRVwjunO+qLKsgNVb9+NZ9dvxQ49+ mvZRos/AykgelL+pXxdSv/uj7f/VCyOwp16UP1F5/zP9Kev/98qrH8bvE985H0/rOqKtCJhQ bmXZ+3opPfz1R8ffffryDE8siI+6vW6ne+rrK2vP+UH7B4li8/Vf9Vc68Z1iU9wmHhKPczZR TAr+nxnxGp67SLwLO1wuVooLwk8VLhKrxCZxsdgi9ojrRKFhiI5Gd6O7GISi/5MYHGh5MTRQ 8eJe8y6zrxiGHk+KUeZWs0CMNovMIjHWTJv7xbhAm4vxZqlZJh43y81yMTHQ5mJSoM3FFLR5 TEyTjWQjMVN2kbeJp2V3ebuYZb1jvSMCVavF7Ej1SHXxhf22/bb40n7fXinW2FvtbeIrW9ta rA80ndgQaDqRVDeo9iI/0HTiazTdLWJHoOnErkDTiaJA04l0oOnE/kDTieOBphMZNN0EQ6Dm phi2mqZmGtFA0xlVAk1nVA00nVFNzVXzjBqBpjNqBprOaImmO2ycg5rTxvWOdCJGZ8dxXKOr 4zlZxu1ONaeG0dOp6dQyejl1nfrGXU5Dp7HR12nmtDD6O5c7ucYgVNsdxhDU2TjjPtTZBGN4 oL+MEYEmMkYGmsgYFRsRm2w8ECgdY4ZX1attLPde814z/uYVeAeN1YHWMDYEWsPYEmgNY1ug NYyvA61h7Ai0hlEQaA1jX6A1jIOB1jAOBVrDOBJoDaM80BFGRaAjjJOBjjDNrGhWzFRZNbNq mW7WsawTZvDfFDaHHmOEHmPiMdNRFDPEM/j0LDGPkvm8lFggXiVLLcSf7NCfbPxpBbvufbzK Db3Kxas+p/zvIiFiYiMvEy/bBKveIrbBrvLFLvZYAT7XRBSKQ+z4w7yaim9EmWgmjvFqLo6L k6KFyOCR1UKPbBB6pAw90gs90sMj+4iqZl/80gv9sjp+mS9yzO3mdlHD/NrcKWqZu8xdorZZ gL/WD/21XuivtUN/rRn6a93QX2uY2tSihoT+i2y81uSdP1ET31Wc8/BFHRnFj7NDP66HH3cR LeVteHMrvLk757fj061Cn26AT+cLw9pu7RGmtdcqFLZVZPkiZpVYR0RD66hVKqpYZVaFaGSd xPtbhN7fJPT+BqH3Nwi9v0Ho/Q3w/t+LbJWn8kRMXaWuEpa6mv0QYT9cS8l16jpK2qg2Qqm2 qq1wVDv2STP2yQ20bc9uiYa7JRZ8AiLi6hb2TBZ7prNoorqo20QV1VV1FS1UN3ZRtXAXVQt3 kcEuuptWfVR/6gxQAykZpAYJUw1WQxhlqBpKz/ey02LstBG0GqlGUj5KjaL+aPZePNx7RvB5 CnXGqccYd7yawN1JahIlk9VkWk1RU6gzTU2nZIaagSUz1UxK2J/CDfYn/cxWs2k1R82hfK6a Sz/z1DxqLlQLKXlNLaLt6+p11mGxeouVeVstxc5lahlrslwtx6pVajXWfqI+p891Cs9UGxU+ qTarFL1tVV+LxmqHKmBNdqsixtqn0qKp2q+KWckDyhfNVYkqYcSD6jA2H1FHqHlUHeVuqSql vEyVYckxdZz+T6gT9Fyuyum5QlWIGuqkOsnoGZWhrVY6+H1VJyIaBNGEd6IJ70QT3okmvBNN eCea8E404Z1owjvRRBhEk7G8j3PGCTOIKcIKYoowgpgiPGLKSN5HuWNE1SCyCElk2SS82OZY UsRjW2KHRdUgyggZRBlRhyhTIGp4u73dItvb4+0RcW+vt1fkeIVeIXeLvCJR29vn7RP1vbR3 gHPf86lf4pVQ56B3kDrfeN9wfsQ7Kup6pV4pdcq8Y9Q54Z3gbrlXIWJextOidjyQ1jWC+MW7 Fbd4j8RtUZ0o5oha8WjcFTXjsXiMml48LuoT12pQkh3PEXWD6CZyiG51ea8Xr0+dhvFGIjve ON6YfprEm3LeLN6M+s3jzTkn9lFO7KPkufhsRpkTf55WL8RfoOe58Xn0OT/+kqgZREMhg2go qgbRUFQlYr1RGQ0n85JhNIwQDWdyPos4KMM4aBMFX+N8kXiP96UCbyMafsj5x8RAKVYTByVx cCMRcxPxVYaf3zthHJRhHKwZxsGcMA66YRysFcbB2mEcrBPGwbphHPSMKkYVETc6GZ1472P0 5f0eYyDvg43BvI83xos4UbK9MMMoGSVK9uQ9iJKxMEpGwyiZFcbEbLPYLBbVwjhYPYyDNcyT 5klRJYyAVaUlLVGd2Odw7kpXVJOdZCdRX3YO/yVbEPsahLGvkewqu1LeLfzXbUEc/H/UfQ18 E1X69Z2ZzGSSTtpSCvQDKlQoBWotpZRaWgSsFYHFLiKyiCT9ELDQNE0RaaCTgBQREREV0UVE YFkFF1lEROSPLIuIyCICIiKflQVEZBEREZF5z32ShlZQKLC67/R3T26euV9JZp57njszp83I D94gFUiFLDboBw8zCR7wFFPh+84xK3m9GPJ6jfmqLc7PbuZuOHu7m7sziXycar4DPs4EH9cL ee7dJPJuCnm3KPNd5rtg4d5NMt9tvhvYz3wPSnIfZyLv1pi8m5W8Wwy8m4Np5gJzAbDQXIjy D5gfAA41DwVyT6eSp7MGPN1I80hYHoKnU8jHqeYKcwXqeswelK/xdF7k/T5uvPkR5LmnU8nT SeTprOYp5imo9YR5Kizc66nk9bSA15tung47930q+b4Y8noSeT2T+UV4PSng9eaY5yD/svll eLS55rkoz/2gRH4wppYflMgPqvCDK5H3+75V5n8g/0/zFiD3fSp83y7kuddrRF6vMXk9K3m9 JuT1osjrRZPXiyGvp5m/NX+LWtz3NSbfF0W+Lybg+87Bx0nk4zRVUAUm+b2VdbS1glmsY6xj gJXWShZi9cI3hVjHWcfBUmWtYhbyU2LI9JDnmUgeJ1L7Gr4mXPtGO8kiyL+Ek2eJhGf5Hvkz 2g8sDD7lPM5z7lMa2CSbxMLgTcwslPxIBPmRSHiQCOS5B2loa2JrgjLcd0TamtmawX5DwHe0 QAvcd0SQ7wgn39GAfEcEfMeLaPMl20uoNc82D+Xnw2tEkNcQmZh6gq+8djp0WzrryQb8Es// /2Mzjhhf8hR4t/9ScRdf56G1vvq2fZCvcFHkvYbef17TJ+GWQPR5jMefFIvuMqqNw3VXdC7f b80KneGq/wiv72b0QuTJX38x9r6oxhFE2u9f/bpMsJ1jP39nfEMYsCNWPIVvtto4jhRc2asV iUbWqr0LpXYyvu7RBLnACmNNdP0bbdbgaGr3q7E/ke2rS60uGEcvXpszThoHjM+w56KrEFe7 1ayS133Hz5/AUV1rvQBjl4L5Y7/0Kxv7Ll7VvF7bpa/gXLbWfONlej1Hq+EbeOLrQ8aryH0Q KFNzZPEz+Dvjoxp7vfo5SMdo9YX3fBXM2FOrxBO0HsTXyvdR7iBGU9tDBb7fK/19adW6+vLl 6r/hSKvVrnHaOId0lq91GT/VKfdr16X+x7bf+Jy/gs2YdQ2V8y7RXjVLxDEYdw2t/vqWyMi3 cn9KPvWSG3zDFV9DvPa54mft1RlV7XPvCusvNVYbSwLXByKNl4zVZP2Cz+61Z++r4g874Rv3 E384TNyEvBmfk4z9eF0UKHWcrrdtRHoPf4frrlyTJ4tmNWuz6zAXfGB8jDQL1p7GNuNDsm/3 swi6ov2n+o/0opF/WecdzaHG32tZio15RonxGF/lN9xBa2fYVvDz7uKrjoxfc734WuhRYw0+ y67rd6bWHA98HoMHq+GFH7DA9dnaY4BfDl4b4ddYLtPyv67XGK92w7dko9en+PXmi/aONNbV Ket/3YPZ7Qt+hFxFf5/wo574Fn1PPIf5bX/gWwMaDxqb6ff+nkmXmMNsLOWiNo/jPPg6cHVJ gueouer0vX/vtc9vF65D171eWcNSOPeiefsg/o5fxD33Efe8xNmOs/k6+65LbT/zZ9su2n/u 55aAvezSdlaf6+j13owh9azgv8diklFFr/8hD/AGT8i9Yiz352hfDT+j6534pd6+itEtNVbA Y74ZeLfOWMj4/UFv8TwSPCe82Dp4iRoW/B943w8DfsJ//Sz0ojbfN9403g20GcnfBex1vINh 1H+0VA9nqfFZ8F1N7HKA52riSj8TJ4/2AT8+/PeIBM6fk+SR7zfy6N27jF/NcyE9jNw0Yybm uocDrdS6twXfwDuG5ypGm29UGnONEuTW4qyeawwl//AEZqO5+J7fNWYZwzC3/odfA6RPttJY bMzx9xyYNWKMtT9r87CxA1Gl/8ztGMwFeKfxgz9dOWOu0/YpOt+DdwXVnaVong5GvsR899N9 D7XvuEiue8fKb7XVvYpLdzB9ffmR0Ce66P6r32KrG8nybxXH8LeX85/061y3SLc+W23+gbOB R1mf4vUXrnQHSx699vEaLxpjjQnGc5T/CMf7y/xOmcA85OeL3xnLkFZfWz/UUor/TpZrauML 4xBmQpof8ZsewnEY5Nz+X904Ac5x4lIMsN59XQXnrlX7Q/+virFwP/ivwLt9gfMnMOrf53y+ 1GYMMR4wVhnLmUjvKo1R8NYOPyMw3jLO4N0Uo8y4xbgRfjTNeNh48Br68vPH5tc03oBP8se0 wfsNX66793puxvzr0AY/enf4vTr47UW/Pu2vNrZemIV/3w2j+RznHK154hjmkWIwUvEzXex9 H+kX7lX9rTeMd2rtMxf8auXvOZ5f3nC2jeTcyX+nq1EOdrQdZ59/37uEnxtvG/cZjyH3pLHb b7vKvt6/9vHWs8dTte/z+t/dghz35LXfXXmpe92v5+Znh+Df/8asdx1WLC53j/Kv1r3CI8p4 ndb2v7r6nmpt0dellSvawIWumbkaT12PkVymj4CnA7u95nX56/QrXa6XL8Bs/8tnyvXbwHpO XbdvJuIaxnE9zvff8HrE1RyN4D3V/pqBJztq1kU203WGzb9a2Rkou6T+/f7W29U8A3FRG794 NeRX6tBqPV8p8kfC/hWd4LVg66/Fx7S2G81KmFL/fqn+VTzlZRymuePCs2Q1a3JXGtuFsDvq 3+vvujW+2or1v/LE+F0N/Lp0MLI33iH8Gv75slcj/tc28P7vfvmZiVrlzvz3x3Jl25V5yKud 1S/5rNRl+6I7CC48O0hXLIJHlvWSlWrK8rWqpuw+nHO/w1aXu/u9BqKny/hZuhLzO6z3Gd9c x7YOsMCK8iWfOGpDTznxK+gfXWLv5drmz1EdqKlZk6MV/gMBS02fnamvn42r1rtHL7RZMxb+ vNZFo+JPZbXnV2muJmo3ZhkLjJXB58ACOc4IAmuaHwXH0f6i8S6of3916l/FnULGVroqsTH4 nu4BAt9UrvhK3xU8vfcLfV/y2eTL1DlEq1Z8JidfQO/W4dzzewbrr/FLmlHCWJcre17zEvWv 5v6Hbfx5S0qn/e8JA6vmv+4dAp+lad37jXB8fWN8TGkWawJO+mXgatJ+/zlNx1px/Ud6mc/h v8JWK1o3HMbDxl+N2aQbELynx+hlLK1ny+t+G8bMx/jL/RjnL3VV2X9F8We2by5/FedqN7pH JuCZjZPgEyfBj3Yauy54IuMYbPyacYbRn96/gSNgh3G/8R5/b7xrPGOs5yvmtO/pOm3vqbHX a0R3GSXGOKNn4B3lcAQOpfwCY57hxnEwC2xtJWZeXmK58aaxLDBr89X5xiyFrjmPNkaQzX8/ 4mzw6hf578FVEoJ3AdVZCzJ+qHmav17jfd54FbHaC4F3m6nvWeTnN9N3wK++LjFOGf+gAv6n 9gN3GASO4o717/X32v4rT2Nf3MuBGo/lv+78e21Xc50Kv/TXrNaqQ1Ah4UrmnoaM379zN+Wb sjTEns2p7r/BOv5Ns0ks62B8gjOU/+0x9hq34HwZyjTDP68H4lScnf6Yqkng/dLAlQqRBZ+Y Jvtrv/I56N4Kw4N5LrACaXQz7Ei9jCGsoeGfg2s0NCqRbjc6G/cYgScbjA3Gbrpbgp+xRzEn HQjEr+1YIs2c7ajUr69uXHpcLxvzgK8G36/ksVydOyv6BTL3sb4sg6WSTkwr2lP7s1vPbzVC zn9PM+UqY7jxBp/DDN14hOfQ6uQ63frvARt+FeMdYZTi85fSGxW5EeQ3H6GZ+mP8lofP+5+k f4tUQWo2+maN8kAbVxDjXbLvLy9f5qI6x+iOAM4T6Giio3kd3ptot/arfIfXCmNZGL3Itl1G x25gQMduPLtTEIVGrIjU6UaTOt0kUqebLAwU7mfThAeFB9kzpEv3rPCQMJnNFKYIz7HFXJ2O reTqdOwdrk7HVnF1OvZ/wj+Ej9i7YorYnm0W08R0toWr07Ft4q3irWw7V6djn4h3ir3Yp6Jb LGe7xNFiBdstThOfZnvF+eJ8Vi3+VVzMvhCXi2+xr8S3xbfZ1+IqcTU7Lq4T32PfiB+IH7Bv xX+Jm9kpcYv4MTstbhO3sTPiDnEH+0HSJBs7K4VLEewcV5hjBinMMVKYk6WWUkvBTApzKqnK hUjpUrpgI1W5UFKVCydVuQjSk2soDZTuEyKlwZJdaMyflROiuOqbEMNV34Rk01um1cJArvom FHClN+EBrvQmDJHD5QbCUDlSjhYe5HpvQqm8Wz4gjOJ6b8JYrvcmVHK9N0Hnem+Cj+u9CRPl 7+QfhUe5xpswlWu8Cc9xjTfhJa7xJszhGm/CfK7xJiziGm/Caq7xJrzLNd6ELcr9ykThU67u Jgpc3U00cXU3UebqbqKZq7uJqjJHmSeGcl03MYLruokNua6b2JTruok3cl03sbXygbJTbMMV 3cRbuKKbmKkcVr4Ss7iim9iNK7qJf+CKbmIeV3QTi7mim1jBn48TdVVURdGrKqpZ9Kkhaog4 Xg1Tw8VH1Eg1UqxSo9RocaLaTG0mTlJbqPHiY1xxTXycK66JU7jimvik2l5tLz7FddfE6Vx3 TXya666Jz6pd1W7ic1x3TXye666Js7jumvgi110TX+K6a+JcdYg6VJzHddfEv6gj1ZHiK1x9 TXyVq6+JC7n6mrhIfUx9TFysTlGniK+rT6rTxCVcfU1cytXXxDe4+pr4NldfE99R31BXi6vU Neo2cYO6Q/1U3K1+pn4u7lX3qIfFA+qX6rfiMa7KJn7PVdnEM6phEcQfuCqbeI6rsok/cVU2 SbBEW+IkG9djkxpa4i2JUqSlnSVZirWkWlKlGywdLR2l5pZOls5SC0u2pbuUYMmx5EhJllxL D+kmS09LLynF8gfLXVKq5V7LAKmjxWlxS52sza0tpSyu7iZ14+pu0p1crU3qydXaJBdXa5Mq uFqbNI6rtUmPhfQLKZQW8af2pHe4Wpv0T82shUmbuE6b9Il2nzZMOsF12qTzXKfNZOI6bSYz 12kzWblOmymE67SZGnGdNlNTrtNmasZ12kzNuU6bqZ02X1tkSuI6baY0rtNmyuQ6baZbuU6b qSvXaTN14zptpju5Tpspj+u0mf7IddpM/bQDWrVpIFdZMw3iKmum+7nKmqmAq6yZhnGVNdNw rrJmKgkVQ1WTM1QLDTU9FBoRGmkazZXVTGNCvw/93qSHsTDB5GWiUA2vF4qIL4yFM4E1wJ/E IjAPm1gU5m4Zs3or2BPwZ2atMQuqLAle0gJ/2Jlp8If8/zx0of+AwT1mKHnMMHjM/qh1L/4a wG/ejxYHs0LWlRXBh3aDD3WDOZTjrzsbyUazRqwCf42Zh+no2QsPGwUPq7FowSaEshh6QjhW CIfPvQk+tzUsiUIiSxHaCG1hbye0Qz4JvjiafHF7+OK7gHnwyLeTXmi0cD/8cir55VTyyx3g l8fCXik8ytKEScIktPkYPHUsPPWTLF2YJjzLOgkz4LXbk9duT167PXntFHjtV5FfCN+dAt/9 HuaD9cJ61ll4X/iQZQmb4M2zyZuL8OZpwI7w6Qr59HDy6SL59HDy6ZHk028jn34z+fQM8ulN 4dNfZTeIC8WFrJm4SPwbayEuhpePJy8fT16+Obz8KuD/wdfHka9vSb6+GXz9v4Cb4fGbw+Nv AX4Mvx9Hfj+O/P6N8PsaayXZ4P0TyPsnkvdvDe8fxdpK0VI0ayfFSDEsh88EyGMmYG0wE7QG JkptUAvzAUvi8wFqZUqZwM5SZ+zNlrKBXaQuKIO5AYi5ARb+rPUd9Kx1D3q++g56vroHPVOd i3nCy7qYfKZHmYDZYhoLMz1lmsFuMT1nmskamp43zWaZppdML7Mmprmmv7Fo02LTmywGM8pb LJWribI0Pq+wLD6vMI3PK8BwOZx1kxvIDVh7PruwVMwu25kkfyJ/wprLO+QdLEz+VP6UmeSd 8mdMxqyzG5Y98h5Y9sp7mVneJ+9jqrxf3s8ayQfkAyyEz0nMxucklDwiH2EN5C/lL1kEZqav mCAfk79Gj8fl/7CG8gn5BGvC5yr0+J38HYuST8unWbb8vfw9xnZGPoPx/CD/gPxZ+SzyP8o/ si7yT/JPaPm8IrKGiqSYWBdFVmQmYIYzM0wWispsikWxsjAlRAlhkqIpGotSbIqNZSuhSijK YBbk/9VdaYi6kUoj1I1SolE+RollEUpTpRlajlPiGFdAbQGMV+LRwo3KjSjfUmmJ8q2URJRv o7RhTZS2SlvY2yntmElJUpJYqHKTkoz2b1ZuRt0UJQWttVfao0yqkoq6HZQOTOMzLvrqpHSC PUPJRMnOSme0kKV0ZbLSTbkdJXOVXGZW7lDuwJjvUv6Iz9VXuQft36840Hu+UoBeCpUhaGeo Mpx1VUYopayb4lJGoseHlFGsu/KwAu+hVCge1lgZo4zBaMcqOj6LV/GhnXHKOLQwXhmPFh5R HmEhygRlAnqpUqpQZqIyEb2AAbBYzgBYChjAUyxNma5MZx04D2DR4AHPYe9MZSaLUZ5X4AeU Pyt/ZlnKLGUWvu05yhzgy8pclso1YFEeXAEtLFIWAV9TcJQqi5XFqPu6soTdrvxd+TtaXqq8 gb3LleWo+5byFuwrlJUo+Y6yCiXfVdZg7z+UtSwdDGM97O8r77Nk8IwPUH6jshGWD5UPUXKT 8hFKblG2YDwfK1tRZpuyDSPcrnyCMe9QdrCblE+VT1knZaeyE3XBUVBrr7IXLe9T9qHWYeUw WjuiHEX5r5SvUP4b5TuUOa2cxrfxvfI9xnZGOceiOY9hHcBjbMiHmhuwNHOEuSGLNUeam7B0 c5S5KetkbmZuztqD5bRmWeZEcxt2p7mtuR3rbE4yJ8Fyk/lmlm1OMaeghfbm9iiZak5FmQ7m DtibZkbsCG50C+tozjRnoq/O5s4on2XOwt5sczb64poCAudMLJVzJiA4ExCcCQjOBARnAoIz AcGZgOBMLIZzJhbLORMQnIndxDkT8uBMLItzJhbNtWpZstpN7YZaYE6wgDmhDJgTEMyJpXPm xDqBOSESUIeqQ1k2+FMpC1NdahnKgEWhLlgU7GBRKOlTfWhnnDoO+fHqeNjBqDAeMCqUf1J9 kqWp09RpqAVexTqAV82A5TkVR506U/0z8n9V/4q+XlFfYXdypgULmBazcqYFBNMCgmkBwbSA X6rfsFvVk+pJ9PKt+i3aAetiKZx1IW+oBv/fWxbGbrcIFoFFcwbGYsHAzEDVorKOFmwsxWK1 WJHXLKHAMAvmX0u4JZylWxpYImBpaGnIsiyRlkjWwdLI0ohlWxpbmsAebYlmaZYYSwy7yRJr iUW+qaUpemlmaYa9cZY4WMDtkAe3w0jA7YDgdkBwOyC4HRDcDghuBwS3A4LbAcHtgOB2QHA7 ZuXcjt0Kbnc3C7f2s/ZjivUe6z3I97f2R/5e673ID7AOZJGc+cHyqHU+E61/sb6GPPgf8uB/ KAP+hzI/hAhMDBFDYthtnAWyDL92A2eBTOQsEAgWCLxPu4810wZpg1hz7X7tftZAG6wNZjdo ds3ObtQcmoPFa/laPpO0Au0B5IdoQ1B+qDYUZYZpw1BmuDYc+RFaCWupOTUnypRqLpRxa27s LddGsjgwy4dhH62Nhh38EjhWGwus1HTWVPNqPtZCG6eNR8lHtEdQcoJWhR4naY/DMkWbipbB QdHLdG068GntGZSZoT2HMc/UZqKd57UXkP+z9meUn6XNQv5F7UW0OVubjb0vaS+x1tocbQ5r w5krSwRznc/aaX/R/sJytAXaq8gv1BaizCJtEfa+rr0OXKL9nSVpS7Wl2PuGtgx739JWsLba 29pKWN7R3oEFfBcIvgv8h7aWtdL+qa1Dmfe09SxBe197HyU3aBvQyybtI1i2aFvRJtgw2t+h 7QB+qu1EmV3a59i7W9uNdvZoe5Hfp+1jaWDJB9BatVbNWnOuzOLAlcezprZHbBNYvK3Khm8J vHkSS7I9ZsN3ZZtim8JusD1hewKWp2zTWTvb07anWQ7n07CAT7MkzqdZJOfTTOR8Ggg+DQSf ZpGcT7NUMLuuxKdziU+LxKT9vLmGMXN+HEr8OJT9CX+hxIx7EDPuScw4gphxb2LGjYkZNyFm HEXMOLqWfo9M+j0q6ffIpN8jk36PlfR7ZNLvkUm/x0b6PTLp98ik3yOTfk8Y6ffIpN8TRvo9 Mun33En6Pb1Iv6ch6ff8gfR7+pB+z12k35NH+j0xYOoh4M02wUYcPZp1FGKEGHBoztQzwNTv YpnExe8W7hH+BDvn4p2FIcIQMOyHhIeAowQPePNYMPJOYOSTWDa4+GPIPy48jvKckXcCI3+O dQUXn8W6gYUvA74pvMm6C8uFd7GXs/B7iYXfRiw8h1j47WDhKUwiFi7V4t8S+PdtxL/vBP/u RSycKwyZSGGoASkMNSCFoUakMNSAOPofiaPfIj4mTmZduLI/6xdg6pyXtxNfF19nbcQV4OU3 EiNvRYy8tfih+CH4N+fiLcSt4lbYPwH/bkGqRc3Ez8Q9YOT7xH1ArmCURKpubcWD4r9hOSwe BnJttzhSNmopfi0eR57rGyWI34gnkecqR4nij+I55LnW0Q3iedFgcaR4FC8Jkog81z1KkGRJ Rp6rH8WT+lFLKUQKgSUM7D+ZeH8q8f404v19pVipKeyc/SdLN4L93ywlgP0nE/tPkdpKbZFP kpKA7aUOrAMigU7IZ0gZ7CbpFsQDyRQPtJeyEA8kS7dKt6J9Hg8kUyRwD0UC/SkSuIcigf4U A+SC/c9goeD9s1kEMf4oYvyxxPgzTMvB+DuD8a9j2ab3TJtYd+L9ObU0mWTSZAojTaaGpMmU R5FAT4oEupE+Uy+KBzIRD2xjCsUAZvkzxAAKxQBmigFCif2bif1HyQflg2D5h+TDsHDerxDj b0KMvycx/ghi/FHE+KPlU/IpIOf0ucTpzcTpI4jT5xKnFxUFnN5MbN5MbD6aWHsu8XUzMfUI YurRxM5ziZebiZdHES/PBRdH3Kskg5ErxMUjiIvnBlh4mpKG8ulKOspzLp5LLNzPuc3Es83E rXsQt+5J3DqCuHVv4taNiVs3IW4dRdw6mthztDJFmQJO+YTyBNgkZ8+ZxJizlBnKDNg5Y+5I jLmbMluZDR7JuXK6MhdcOYu4cixx5WxlgbIQPH4RWHIsseS7iR9nK8uUZajFWXI6seS7wZJX oO7b4MqxxJUziCtnK/9U1qGF95T3UJ5z5XRiybHEkjOIJWcTS85RtoIlZxFL7kYsOZ1Ycjax 5K7Ekm8nltxR2aPswV7Oj/3MuKNyTDkBC+fHGcSPM4kf362cV86DoXJmnEXMOBvMuAnynBN3 JU7czdzC3Ip1J2acQ8z4XmLGtxEP7kY8+F7iwTnEg2PNncydgJwB304MOMd8q/lWtMkVxcJI S0wmLbEwUhELIxUxmVTErKQi1odUxGRSEZPNfc190TvXEpNJSyyMVMR6kYpYQ1IRyyMVsRhS EYshFTGZVMRkUhGTSUUsjFTEGtZSEQsjFTErqYiFkYpYDKmIyaQiFkYqYnItFTGZVMTCSEVM JhWxhqQiFkMqYjKpiIWRilhMLRUxmVTEwkhFLI9UxGTSD5Nr6YfJpB9mI/2wMNIPk0k/LK+W fphM+mFhpB8mk35YGOmHyaQfJpN+WBjph8mkH3Yn6Yf1Iv2whqQf9gfSD+tD+mF3kX5YHumH xZB+mEz6Yb1IP6wP6Yfl1dIPk0k/LIb0w2TEMA1ZJiKWVqwbxSfd1dZqa8QGiWoiuH47tR3L UJPUmxBvJKvJsKeoKYG4JV1NVTuw2yl6SVfT1Qwgj2Fy1M5qZ7TDY5juaq56B7CH2gut9Vb/ gDJ91D6so3oXIplsNU/tiwjhXvVe7OXxTFfVrtoxngK1ALX8Sow8wslBhFOMvniEE6qWqW60 U66Wo9ZD6kPsNvVh9WFYKlUvPgWPczIptokl5cZ0inCy1KnqVCCPc26nOCdLfVaFl6A4J50i nGz1JfUlWOap89A7j3ZyKNq5V31VXYhaPObJVv+m/g1lXleXAN9A5BOi7lW/AP4bMU8IxTx3 UMzTXT2lnkLLPObJVH9Uf8Sn4zFPCMU8d1PM041iniyKdtIp2smkaCfdYkOEk4UIpwHrShFO DkU4t1GEczsinMaIgppYolAyGhFOBsU2sRTPdEc80xq9tEU8E4J4Jg2YbskEZiOGCaEYJgQx zF1AHr2EUPQSQtHLHYhe+gUiFh6rDEAcMpAilkHWQbAUWgtZF2uxtRg4wjoC6LQ6gS6rCzjS OhLItegakBZdA9Kia0RadI1Ii64BadE1oMhHotjmjyGxIfHslpCeIX9kXUKKQjysHynVmSja MSHCaYcogscw7SiGaaM9gBimhfagVgymzuOWFhSxtEPEUoq8SytD5DBKGwULj1Vu1MZoY2Cp 1LyIUnh80orik3YUn7RBfDIZlscRpbShKKW19qT2JMrz+KSd9qw2A3ufQ3zSGvHJ82iNxyet KD7xRyY3UmSSrL2svQycp80D8sgkjSKTvtqriEzaIzJ5Dfa/aYtZCkUm7Sky6UCRSRoikzdg Waa9yW7SlmvLUfJt7W3YeXxys7YK8Umytlpbjb3rEJmkUEySRjFJX22j9iH2btI2w84jkw7a Nm0bSvKYJE37TNsF++eISTogJtmD1vYiMomjyCRF26/tR788Pkml+ORm7QsNHI/UAZNIj7St dlQ7BgtXCozXjmsnkOd6gQmkFxhPeoFJpBcYT3qBN5AeaZz2k/YTkGsHJmmGBgZICoItQczB AElH8AbSJo0jNcFmpE0aR5qCCaQpmETapG1tobYw2Lm+YIKtoa0hLFxlMJFUBm+wRdlisJdr DSaR1mACaQ0mktZgS1u8LR57ueJgAikOxpPiYEtbsa2YtaBIrBUisXEUieF4sD1qexQR2iRE X60o+upAcVdfxF3PIj/DNpOlUPTVwfaC7QXkuXJhAikXNiPlwiRSLkwk5cIEUi40MSH2ZFMf yK8mTWb7GHMMRHIgDUEageRGGh18FVwL8aojTUCajDQNaQbSLKS5SK8gLUZahrQSaQ3SeqRN SFuRdiLtZaJvIyXmOEhJ9G1B2oH8UaQTSKeRzjGWLyKpSKFIkUgxSM39Y8hP+IXXJH9b+amB xOtkIHWhfSw/B6mnf7xUZ67/M+bnIfVHGuS3B15F325KgmsJ0nLkq4M2fzqCdDyQ34F0KpA/ 60/jWCApSBpSBFIUUpy/7LiWVJ7lFyAN839P+c7gd+4v25bKsfyRSB4kH9LEwGeY4u9vXErg s05Hmok0O7B/fmB/eiBlwYbfMZ9/nlVIa4Ofxf+ZlyOtQlqLtAFpM9J2pF1I+5EOBV6P1Xqt KX8S6UzgdVeg3pla+88zVmBCsiKFIzVGanrhlf9+BfFIiVf8Ko7rfuG34p+tIDnwW9c3xdRN dHxP9vdDx1WMvxz1WzulIWVeeA224W9XHNcD9q5IuYHjD/sKel94LeiLNMDUYPD+kp6VWxwT ShmhQqgBJ5dGAKeVRgFnlMYBZ5W2BM4tbVu5hdfyDnK8UpriLRh8qCSvcsfgYyX9K3c7Fpem E2YF88tKu1fu5nu9wwafLBlUWe1YWdqjstqfD+CZkoLKI441pX0I+wHXU3495TeVDgRuLXUA d5YOAe4tHVF5hNfyOoHDkD9f4qw87jhY6gYeLR0NPFGqVx7ndu9Iu6lkZOUpx+nSCcBzpZO9 Hru1xFN5Nl8snUY4g3AWUM3PAYaWzgVGlr4CjCldDGxeuqzyLK/l9eUnlK7UZ9nDS3w6vtnS NTqzNy6ZqCscvRPtTUum6Fp+aul6YEbpJl3jFu8Uvz2A8SXT9Qh7YslMPSq/S+nWIOaU7tSj uN07PYDJJbP1uPyepXsJDwLzKN+/9ChwUOkJYEHpaeCw0nNBdLpE78z8kS7VO9ueVjJfb5nv cYXqLam1tgGLzxVZg9zinW/PLFmop+RPdMUQNq/Jc7t3ob1ryRI9PX+KK0FP53nvEntXVxLy uSXL9az86a5UwoxgfqarC3C2Kwc439UTuNCVB1zi6k/5QXoWr+tdbu9dskrvbu9bslbvkb/c VRDEVa4C76r8ta5heg/7gJINeh/74JLNNAYn4chgfoPLg5EUlWzX++VvdvmCuN01Ue9nLy7Z pQ98cE2Fj3Ai4RTg+orpwE0VM4FbK2YDd1bMB+6tWKgP5LWqPA8erFhS5bO7SvbrDvuokkP6 kAePViwHnqhYRcjzpyvW6kP43qqJ9rElx3TlwXMVG3SlWCw5VjXFj/bxJSf1EcVqxWbC7cBQ yodSPrJiFzCmYj+wecUhYELFMX0Er1U1HXgG+Ukl53V3cVLFSWBqxRlgRgUs3F410z7VadJH F3fxcMzxWKtm259xWnW9uKcnnGPxRMo3BuZ5mgL7e+KBgzyJwAJPMnCYJ03Xea2q+cVOT2bV QvsL9mp9QvFIT1d9gn2OM1yfzHFcS/sCZ2N9WrHHkwv0eXrr07ilaonfHsDXnE31Gfalznh9 VvFET98gTvEMwLkDe9XyAK5wJupzi6d7BhMWBfMzPcXA2R4XcL5nFHChZyxwiWc8cLlnUtWq 4lWeqd4C+2pnsv5K8VrPM1VrqbXFAcsGzwvAzRy5pWqDfZ0zTV9WvN0zh3BBTZ7bqzbbNzoz 9ZXFuzyv6St5vmp78X7P0qpd9i3Orvqa4kP45oGeFcH8Mc9q4EnPOuAZz0bgec8Wfc1wk2cH 0OrZra/hdav223c4c/X19t3O3vqm4eGe6p9hY88RfZO92tlX32o/4hyg7xze1HOc8FQwH+85 q++0H3cO1vcOTxzDgpg8RtH32k85i/SD+btcUwinA/dT/pBrJvCYazbwpGs+8IxrIfC8a4l+ kNfyri0wuZZ7N9jPOov1ow7mdOknCqyuVcBwwsaETV1r9RN8r3ezQ3GO0k87FNcGjjxfEO/a 7A11aM6x+rmCRNd2wl0/yye79gPTXIeAma5jwK6uk/o5Xsu73RHhHO8VHVHOSV61INd1Btjb dR7Yt8wEHFBm9aqOOOdUb2jBYMKisnDvLkdL5zPeyILissaETQnjvZGOlmWJyLvKkoGjytKA Y8syuR3l9xeML+sKy6SyXO8hR1vnC96YgqllvYHPlPX1xjhSnHP0rRy9xwpeKBvgPelIdy5A +Tllg9FCelkRR1j2++0BzHK+5m3u6O5cirEtKCsGvka4tMyFb4bbzxSsKBuF2ZPyjh7OFd6E gtVlYwnHB3Fd2STgxrKpwC1lzwB3lL0A3F02B1hdtsB7vuBI2Ws+E9pZ7U1yxJUtBXZ3rgP2 cW7EOI+XrQCe4kiW/Y5+zi3e1IKzZavrIrf7ELaWrfMmFCplG33hjoHOHd6MQq1sizeD532N HQPLYHE4nLvpc/mxuiZfGFF2BBhVdhwYV3YK2LLsLLCtmwFT3Ao+O697xjHEWe3t4hjhPOLN KUx3az/DLHeEN8fhdh739nSMdp7y5hV2d03n6I4KYg93nDfPoTvPevsX9nG3BPYjHOhuC3S4 U3xNOSfxxRcOcaeDn4Ab+BILR7izKo8Uut3dgaPdPfwzuC+Zz4O+tELd3UePK5zg7qfH8ZnI l1k42T2Qz0puBxBzja9r4TT3ED29cIZ7BOYXnC++3MJZbrd+kB+3vt6Fc92j9XOFr7h14GL3 BP8x5uvLf1/fgMJl7sneBEcP9zQgvgff4MKV7hn8O3HPAvo/6Rr3XOB69yvePJpxDg1PG6Nh 9uGe/9jwzDER+ojhXcdEAXPHxAX880nu5arODO89pqU+175iTFsg9zPnh/cdk8J9zph0IDzJ RNPwAWOy4D0Gj+mu76Qjf3/hJvdiX1HhVvcyX3HhTvdKn6twr3uNb1ThQff6yt2FR92bKqsL T7i3+saizE6UOe3e6xtfeM590DepSHQf9U0tUt0nfM8UhbpPVx6393af07sXRZaLvheKYspV 3xz7gPJQvU9R8/JI3wJ7YnmM7zV7cnlzPa4ooTzBu6EoqTzJt7QotTzVt8LPN4oyyjN8q4u6 lHep3MIZhW9dUU55jm9jUc/ynvxXKM+rmdmL8sr7Ew4C9sfYthQNKi/w7SgqKB/m2100rNzp qy5ylo/0HSkaWe7xHS/6f+x9f1QU2Z3vraZtehymh2EYhmUIYRjCEEIMIYbwWJYYwxAGG2QJ cV1CmB66fnVVddM/qqtbaRvobltCfBzGdQnrM8bn+nwcYjjEwzOGZwzx+VjX5RAOcX2sx8cx LscYHofwDGF9xmPe996qbltkMu7Z/W/3fM/nW23VrVv3x/f7+X7vtUr3e7q719Sc9n2dJwpZ nJpHkSyF7vYchtyV5I101HME9GHPEGRx2DYevt/uAU0f8ZzuQfSQZ6THQJ/wjPWk0Kdxyff0 nvMH1ugRz8WeNDVzsxz3XD4wS495roKPkxyVPu+ZOXDv/SzP9QMP6Yuem/B03nMbxuGy5y7o q57lYD4947kPOdiI5wG057rnMeibsr6737Iub4X6b8upPZn0XTmjexaPQE8OvSxnq7bdk0/f l/OgngdyYbCMfixv6yli9PL2nhI1w2S2yhU9ZUyqvKOnEvtFz04mQ66BLB1y9Z5aVTPZslnN wHsaEnQz0S3kKRaiWSZPbjpwjymU9x5YYbbJbQfWcEbdIzHbZVr77Sbaj/2rJ6iNJOTDPRGi +3CregaYClnoGVB/Ez3I7JCdwTSmRlYgH4asuOc4Y5YDag7ccypBD0OmKgfzmSY5BHov1jhr 7RlVNdMm96qZas84Q8v9wRJGkI+ChvNwxikfU7PW7h1PdM8E9vqeSaKnVM0o8knIRSEj7Zlm AvIZyDwhL+2ZY0Ly2WAD0yufA+2UL0DOOSNfgtwSz8u8qpl++UrPQnuefA28GzOziTkqz0L0 zJNvwO9j8q2eRUuOfAdHBPlezxJzUl7pus+ckdd6Vpmz8sOedeacF/U8Yi54DSGdxu2EvS0t 3pSQkbnkTQM29nszQyaVCZkr3pxQOnPNmx/KYmZdNaFc5oa3KFSg5gDtgrcEYgGJMswtzNtq jGbueMtCxcw9b2WolFnB0ZZZ8+6EqAesFSpvn/XWhsqZh87roar2o96GriwWeZtDWVpcPuNt 6TKxBq8F5xJeNrjIpnglHNO97uAjNs3r70pnM71BeO4tbwTHLy9wIJvjHYDz+d7BrnRrifd4 LFKwRd5ToWq2xDsMbYNcoieNLfOOds/i3oXq2ErvuMq0XdfZnd4JqKfWOwlRAGJuqJFtcJwL 7cFxKtTKNnunQu1si3c6xLMW71zIgcctJJN69rOsdz7UzUreBVjjAIeHomq2g3V3m6pjWY1D CR3GWj0TOkL0EG5D6ATRp1m3d7FLx/q9S11GNoizEZyZdLexEe+q+hviHWi4C2JBaASzbmiE 7fOuq3lFaEzT0IvuJnbA+wjiBflN+jXCDiq6rlz2uGKEjALyitB59pRiUrMIaFVch4bazyjp XcXssJIFelTJVSM+1AM6dJEdVwrUKB+6zE4oxV2l7KRSChrOw5kppVyN8qGrCXoGx6nQdaKH iL7JTitVELshgodus3NKNURqiOOhu+y8UtdVxy4ojaAXlT0QxRqU1q49ZMyXib6vjcyS0t5V zq4qfFc1u644uhrZR4ocXOR0yv7QA5HurI1uFYXOhkiD6OxsBq10tgQHxECnJciKoU42aBB7 O6VoKpRxw9X+Tn80QzzaGYSrxzoj0WzxZGdfNE880zkAq6GTnYPBPvFs5/Fo4XtHO08Fg+K5 zuHoNvFC52h0u3ipczxaARFzInhKvNI5Ge4Vr3VORXeIs53T0Rp1dfDetc654IR4o3M+ahZv 7T8XbRLvdC5E94r3OhdhHXevcymeh690rkbbxLXOdfj9sPNR+JyEArooLRkCxqggpQRMUaeU FkiPKlJmICsakHICudGQugIV6gIFsOZSVzpkTSHlB4qjveoqTyqCM26pJFAKay6I9dF+4XSg PNovFgaqokelskB19JhUGaiLCkIxLvlef6Ax6Jd2BvZET6rrLNtkoDW2nlXXmFItWVfWCXfx ii/QHn/6SIAHTdZKUkPAASsmdY3zGNaYk1Jz52pPpVAVkKH+lsD+6BnJEuiGdRaMQPSsxAai Wq5yRJICh4OnJHfgSHBe8geGouekYOBE9IK6HpQigdPRS1JfYCR6Bec50WvSQGAM1tSwso7O En1DGgych6gBK2iIF6Cjt7DuImvq6B38lOg9VUvHAxehR6dgzeWWhgOXg368/o2uSKOBq9rv NaIf4nzpENJGElavhwyahlYdSpHGAzOHUtTfRKdJE4HrwUFpMnATVq+whj2UKU0Fbqsr1kM5 CTpfuBq4CyM2HVgGPYc1XmN271W1NB+4r64rDxVJC4EHwXFpMfAYNJyHM0sH9Ooa81BJgi7D WdyhSqJ3qlpaPbAVVo6wfjxUK60fSIV1IqwiDzVIjw5kBOfsugPZoI0H8oLzdtOBwmgbnpdD zUS3vNd/YFt0xZ5+YHtwwp51oCI4bc89sANKFhyoCbZwRqU79JisHUg8ItwFaxbOpETDei5d ORzeajEoR3rSuCxlCMcO5UQ4lcvFGn6fDmdwBcpIOBv0WFwXK+fDeVypcjFcyJXDXUZ1TcdV KZfD27hq5Wp4O1enzIQruEblengHl4X5k+gH3B7lZs8qZstwDdHm9pByuyuda1Xuhpu4dmU5 vNdSptzvus3xyoNwG+dQHodpogXMk2GntrYCHVY42acPB9R1FrfftzUc4rp9qeFeLurLCPdz h33Z4aPcEV8e6CFfYfgY5szwSaLPcCd828JnQW/v0nGnfRXhc9yIb0f4nBpTuDFfTfgCd95n Dl/iLvqawle4y7694WvcVV9bTyVhUSM346ODLHfdJ4RnuZs+Z/gGd9unhG9ZJF+gq5q76wt1 VXHLvt7guBqhsA7fsQQhGsJvX39ov5q5Mam+o+F73H3fsfCKBflOhte4B74z4YfcY9/Z0GOu 2HcunMfrfRfC2/itvksRxKf6rkQMfIbvWiSFz/bNBgf4PGUokpZYG1/ouxHJ5Lf5bkVy+O2+ O5F8vsJ3L1LE7/CtREr4Gt9apIw3+x5GKvkmP4rs5Pf6DZFavs2fEmngaX8aaMGfGUnTtNOf E1zkFX9+pJkP+IvCIT7kL4m08L3+soiF7/dXRlj+qH9nROKP+Wsjbv6kvyHix/MbCfJnLP5I hD/rb4708dl+4Hz+nN8SGVDnjr/gZyOD/CW/1N3PX/G7I8f5a34/6Fl/MHKKvwG3DvO3/H2h dEutH1ZY/B3/IOh7/uORUX7Ffyoyzq/5h0E/9FVEJmzIP9qzYDP4x4MGW4p/IjJpS/NPRqZs mf6poGTL8U9Hpm35/rnInK3IPx+Zt5U4ZnsqbWX+hXCFrdK/GFmAkktQcqd/NbKoPsVW61+P LNka/I+6Z23N+3SRVYuBLwyu21r2GSPrlsp9pq5cm2VfeuSRjd2XdVBnk/blHjTa3HzgoNHS vA+is82/r/gg5HL7Srv22IL7yg+m2yL7qg5m2fr2VR/MtQ3sqztYwJXua+xZxfpgsbrqtw3u 23Ow1HZ8X+vBcpy9HKzCWcrBaryLcrBO9Tiyg3FY26l42jsuaXsFZGfgYKPt1L72cCGO7wf3 4DX4wVZsjQfb1d0hwg8PbMPKENRPMjHb6D6+6zpXsM/RdV3bvSH7KrZxh/Mgz93fJx90qKt+ 28S+/QdlPNfdTUiHXqdWqf+LEPVbah3pqIfU75Ce+r2OQgbdFp0BvaB7UZeCXtSl6l5BL+le 02Wgl3VZujfQK7o83VvoVV2h7pPoNd13dN9BryfVJr2LMrfUbPkKytri3uJB2Vt+uuWnKMcE gj5uyjXVo1xTo6kVNZjeMx1EXzd9YPoJCpmumpbRD0wrpnV0A1rzp0hP/vcDE3oZvYBeQc3o RbQHtaPdiEbfQq3oP6J+FEED6Ocoiv4e/QJdQ/9IbUX/i0qhXkK/p16mXqMoCn/jZMTvTVKv Uy0UR2VTNipKFVG91FGqlhqivkN9jfpv1M+oryd9P+n7lKKX9V7Kp+/Wh6h9+l79t6iA/gP9 B1S3/tv6v6J69N/V/zUV0Y/qx6hv6s/rf0Qd1v9E/xNqQP8/9X9DfUC+xzyqn9P/nPq2fkF/ m/or/V39r6jj+l/rf02d1P9W/0/Uf8Zv0VGnt7y65VXqv275+ZbH1LBhiyGfum542/A2tWb4 pGEb9VvDFwwV1O/wFx7U7w1fNlTr9IYaQ73OYNhtaNWZDO8baF22gTW4dbkGryGo+7Thm4Z+ 3RcMA4bjuj8xfNdwRleHv5zQNRlGDX+n+6phxjCjcxlmDfM6t+GW4Zau03DbcFsXMPzSsKQ7 gN/H0vUYfmNY00UN64bHut5klPyS7oPktOTXdN9Nfj35Ld1fJxckf143lvylZEk3mexJPqJb Tv7L5L9MSkn+dvLxpJeSv5c8mvQq/n9Vk15P/mHyhaTs5Inknybl4PeBkgqS/z55Pml78s3k u0nlyb9K/qekd4wFxnNJzcbfvPBm0i9MvzP9To+/l5NQL+gUlIO/Nt45psEIKEYFUnvtA4mv rn33RnWJ5JBkaX/tbalbilZLjQPSeemidLl6QroqzUjXpZvSbemueas5TzpsVqQj79S9w0tD 0gnptDQijZnz3qkGq9KDja8SG/8toqjfU79HOrDoVJQE1z5G3kRFuu/pvoco3fd134drY7of oCTdj3U/RlvIm6gG3c90P0NG8iXYC7qf666jreQd1BTy9ulLul/ofoFM5L3Tl3W/1v0avAO/ WZqWRCVR8f81eEuSAWWQL8cykzKSMtAfJWUmZaIs8qboG0mFSYXoY+SrsJykyqRKlEu+AXsz aUfSl1Ae+Somn7yz8QlofwqVRkYOayReQQHxinhNnBVviLfEO+I9cUVcEx9KSFyTDFKKlCZl EuRI+VKRuCKVSGVSpbRTqpUapGapRbJIrCRJbskvBaWI1CcNSIPScekUwbA0Ko1LE9KkNCVN S3PSfKLY90gL0qK0JK3GZV16ZNfZjQlisqfbs+y5cLbgKWm1F0DZYnupvVx6FBN7lb3aXgca S6O9XVq181DWYW+3y/b99m571H4Y6iywH7EP2U/YT0P/qRckjTXwN+uvkDHJBElC2SB6VIDe RltQMUgy+gyIEVWAvIAqQbaiKpAXUTV6h7xdvgtYB393+TL6c9SCUlEbSBrwDo1eRTxIOvIg mXxxuZ98a9lF3igPoyzgow/QG+jbIB9D/wkkB/0XdAZ9HH0P5E00CpKHfgTyFvrvIPnoxyCf QP8DXYH2XQMpJP8b9ifRPPoHVIT+N0gx+keQT6NfgmxD99FvoO0P0P9Dn0WPQT5H6ahktJ3a CtxXQd4f/2PgvlRUSd4fr6JyqDfRF6m3qLfQl8n3ntXAho3ki84WVEN9g7Kgr1DtVDvaRd4l N5OvO+spiZJQA9VBdaDdlJdSUCN1gAqhJuDOKNoL7PlN9OfUt6jD6OvUADWAvkG+7mwDJr2A 3qMmqAlkpSapnyKamqL+BrHU31J/i3jq76hpZCP2KwILFCLJWGQsQh3k7Tyn8bPGUuQib+R5 jBXGCiQbq4xVyEu+JFLI+3c+o8X4PtpntBqtqBPm9i5aJ7Zfhv9lCWEcMAGYBEwBpjXMaZgH LKA/EyaESWFKmBbmhHlhQVgUloRVYR30I1EnGkFMYrqYJeaKBWKxWCqWi1VitVgnNop7xFax XeRFhyiL+8VuMSoeFo+IQ+IJ8TTIiDgmnhcvipfFq+KMeF28Kd4W74rL4n3xgfhY6pX00lYp VcqQsqU8qVDaJm2XKqQdIDWSWWqS9oK0SbQkSE5JkQJSCKRfOiodw/+D6Jb2LTYIgt8wtZF/ X+GdfzX7rgd5mVh5KrHyV4iVv0qsPJ1Y+WvEyjOIlWcSK88iVv4GsfJsYuU5xMo/Tqw8l1h5 HrHyt4iV5xMr/wSx8gJi5W8TK/8kmgYpIrb+KWLrxcTWtxFb/wyx9RJi658ltv45YuufB1vX oTJi318g9v0fqI9ROWD32LIriWX/CbHsKvJ9xBeJNe8g1vwlYs07iTV/Gaz5APhAF9UFPoC/ kvgKseZaYs111F9QfwH+gG3aTL6PqCfW3ECsuZGaBjtuomaoGfRV49eMX0PNxhZjC/qa0Wa0 4e+1U7tT+2CeUmDsX0SUqw3srhRQDqgCVGvn6gCNgD2AVnxO/4qw3VUmzv1hkDLz7utChatS 2OHaKS48DXxOqHHViouAJfdNDMHsahBX/zBwGaHJ1SzsdbWI60+A/yy0uSziI5dF0rlvC7SL lYx/GKSMyX1XEFySlO6SBKfLTaC4/FIWINftIL8L3MtSsfu+EHAFhZArIpU+AflzufuB0Ovq k6o+AtXux1KdRy/0uwYIjroGhWOu41KjCvwb903a8wSkryddp6RW1yl8JDjjGpbaPxq4nHDW NSqcc41L/NMQLrgmYvUmQrjkmpQcTyBccU09D5xtyjHhmmtamHXNbYobrnkMJ62cxBBuuRae C3dci8I919IzWHGtYjgFT7+w5lp/HjidyhnhoesRhojcOgKD24jhVJSz+Njh8I6IFne7mOI2 iWnu9I1wBpRzYqY766PgDCkXSB057lyCfHeBWOQufgol7tJnUOYufwqV7qrnxk53tVjrrnsG De5Gsdm95xm0uFufAu73c0CSPVtF1s2LktuxKeCatN+TKnV7Mkg5t1t+Lvjd+8Wgu/sZ4Pqi gMOebDHijj4PpCOePLHPfTiOAfeROPD1IcAJTyH5fdqzTRrxbBcH3UOkvRsgjXkqyO/j7hMf Bem8Z4d00VPzVB2n3KefwrB75Bngey97zOKoe0y66mkixxnP3s3a86EYd58XJ9wXn8Gk+7I4 5b76DKbdM4mQrnvaYtyeyMUxroxz3E0PHeeg2x4hkUfidpI4r7F5iY3RXY8zPrbLHiWxTYRL eoFTwPed/SoHOI+q/kv86pg7i8QNsHfnScAZ5VLMnp1n4QjPwdel+56A9MATkh57eu16Tz+O L/atnqP4PO6bPdVzzJ7hOYn51Z7tOYN50p7nOWsv9JzDMcC+zXMBczvpM9i7fbvnUoyf7RWe K/Ydnmu43/YazyweC7vZcwNzJ66ToMlzy77Xc8fe5rlnpz0rdsGzZnd6HtoVGeHxJTEIjyWM oT0AcVKLZ/YQxB9tnO29UE+/bMB1kGtH5RT7MTkNx514rE2Yo3idGFpMicUC3CYcG+0n5UzS tjNyTmyeSXnM/TD3JC5DzCN9Oyvn43P2cxDDK1TgeI3H9ymY1biM4xWJx/CcWCzGRwKwH9K3 DTGWPAtgv+AKYuAYG4urMdgvuQYw4jESx0wtNibGyqdipBYnY7BfgTgIc0xiH8RD+zXXBAax WxznLqmIcxbAPisXkeMNucR+Sy4j54E/7HfkSvs9ead9Ra61r8kN5Dz2YRxLsN+CH2F/sj+U mx1IbsFc5DDIFuIXMT/QeJHYFtSDec6RAtyk+QiZL+AtfH+MA5/xrQ1+FeeXWPuhDsybjjSZ xXPuyJSl+P24PPibI0d2O/JlP263o0gOOkrkCOFw3B/og6NM7nNUygPkvo/iH61djp0aj8d8 PJpQRmsz6esGPo73B/NwDB/2rA/hU0etdmxwj+E+xbGRJxO5EvNjjCMTORHKknpwGXwNxsDR 7DE7zylXnBeUaxg4t8HzTfKaS8osOQec5ZjzmpxXlBux/MV5TbnliMiThMcg73DOKndITgGc 5hiVlxxBeSKWEzhvKPcIp+H4j/MGzHW3lBUco513lDXnPeWhY1J+5FzxIeeaz+B86EtxIV+a y+DLdKX4ckhOpvEluRfnZlreRHKeWI6C69LqwNdcab58zJe4XfHcLpaHrT3hYIJYDqPlHrgu nI+5Mn1FON9x5fhKYveT8tAf8mcYL+In0DdXvq+MnMN5YwxanvgUNuaCWu73FLRx3ZjXxYFz sRg25nWxHG2T3MxVpOIjczOceyXmXzjniuVdCTkWbiu5F5fRxuQZ3wL/c7TIg8/4lUU+Hsux HKx8yiHJw5iLYuUcbnkU27XDL48Te4rxAC6DfQ7sjxz75CnHgDxNfg/Kc47j8jxGor85TskL mCMcw/Iisc9xefWZPAbgmJDXCcAeMYgfYt6a8urIcdprjPkg9gnHvDfdseDNivsf5qBFby7h miVvgWPVW+xY95bi2BMD7i9eYxH/gz47HnnLO3TeKlI38EeH0VtN+qmV7zB56zrSvY0dWd49 HbneVsxFHQXe9o5iL99R6nV0lHtlHP9IDMT8BDlBR5V3f0e1txvzcUedN0rWLBALOxq9hzv2 eI90tHqH8Hh1tHtPdPDe03id0CF7x/A4dez3nsflO7q9Fzui3ssdh71XcQ6I+T/GzR1HvDMd Q97rBFAfjjPYtjtOeG/ice847b3dMeK9i+2sY8y7TDgM5rHjvPc+uXbR+4DUcdn7GHN5x1VF 3zGjbO24rqR23FQyOm4r2R13lbyOZaWw476yDY9vxwNlO+Ex3P/HSgU+OvXKDmwPzq1KjTNV MTszlCZntrI3bj+Qg+P8w5mntDkLFdq5TRHIeY1zndsVp7NCUcj8gZ84dygBZ40ScpqV3rit xtYBsRgFv51NSj8u49yrHMXnkA5RpqhpAKF//xuUf0N/g7KM7j/5ewB6HUlMFpPLFDDFTClT zlQ165lqpo5pBL2HaaXXVWFyMZh2hqcfqcI4GJnZz3QzUeYwc4QZYk4wp5kRZqy5nznPXGy+ xFxmrjIzjEmTIwTXmZtMuia3mbvMMnOfecA8ZvXsVjaVzWCz2Ty2kN3Gbmcr2B1sDaOLCZQw s03sXraNMarC0qzAOqGcQlqIW4RL4mv4efAEvM//0gjY9rv/Kvug9eAbu0FeIfugaWQf9FWy D/oa2QfNQDwS0OtIAskiu6FvkN3Qj5Hd0I+T3dBcshv6JtkNfYvshuaT3dBPkN3Qt8luaCHZ Df0k2Q0tIruhnyK7ocXgc9NoG5oB+SzZDS0lu6GfI7uhnye7oWXol+hX6Avo/4BUkD3RPyZ7 on9C9kS/SPZEd5A90S+RPdEvUzlUDqome6LvkD3RGrIn+hWyJ1pL9kTfJXuidWRPdBfZEzVT B6gu1ED1UD3oT8meaBPZE/0q2RP9GtkN3QOe/kP0Z9SPqB+hFrIn+nWyJ/oNsif6nr5P/y1k If/SYLv+gv5HiAa/nkKs/p7+V4gH/12HsaSQHwWf2KoVemy9Yb1lvWO9Z10BWbM+hIE30Cl0 Gp1J5xBhaYl20346CBKh++gBepA+Tp+ih+lRIvl0EV1Cl9GVRHYSXUs3gG6mW2gLFmw3uk+B 3Xxas5s08nxsMTqYo7fBerCt6GH8S8F6sK0YiK0kg6W8AzaE98xfAOtoARvC9vEisY8Usk/+ EvRLBEvC1pAKtvAB2BO2gzSwgjNgT9gC0tEPQF4jFpBBLOB1mP8rYLd4P/yPYM7/ASwMz/ob ZNazyR74x2Dml1AOmeNcKhXm+E0yu3lkXt8iM5pPvUdZ0CfIjL4NM+pEhZQCM1pEdrk/RR2G WSwms/hpMovbyJ72Z6gfUhdQCaKMZcbKhPko0r9iLdoo9H6621piLYsJXWCt1GTnRqGj1lpr gyr0YWuztZk+Amc2CD1En7C2gFhAWCz0aXKUrO6Y0CNW/7NCj5Ea/NagJhFV6PPWPmsffRH0 wLNCX7YOWo/H5RQuq8mwJqMbxTZqG7eOWydiwq5aJzWZ2ii2Cet07Fm2SescyCk4s0GY7dZ1 6zwIft4CFr6QNsFxkdxBhFl5tnbrFF9DapiKjax1SRXblHXVumobBr3+rNimoX+P4tJA6+Ji VGWTkbpKz9AmOj0u1+ksIjefjERM6Nt0Ll0QEzLjd+niDbIMuE+XEikHeaCdf8zoQVfFe9Rg DTJb6epnhUml65gMupHeg4XJpltVYfJoB5xpp9uZQro9oZ64MNusSzQfFwctx0QdfesCzAjY N1NBbLeW2cHUYBtjzHgkmCZsH8xe+NVGelvM0IxAWiSQvqo1YUuZI7M0bZu3LRBrWCSjv0RG eplxgu+UwPiVWSsZxTrMBGCUTUwI2tfL9IMtW5ijYO9+5hitY06CLQ+09zJn6HJ4bj/YSQTK nmXOMResj5hLzBXmGrQY2/8AM0t6aYEZu2qNMDegRANzi7kDdWGvJT0iJVVfwbMbsTYz96D9 K9DnNTjfB+XKwOv6mIfwq4RpY5G1kjWwKWwam8nmsPnEl5tVYYvYEuyvbBlbCbKTrQVvlVSP ZRvYZvI0eBLbYo2wFuyTLNQMJSXWzfrZIBuxDrJ9mv9hDxxmB1gJbM1E7C0Lrg7SdXQ5e5zO Yk+xw+wo3cqOw/zCbDH97AQ7yU7ByBXT1dCmQXqGnWbnoPQ8yAJdyk4QC8S9JHOFy4GAxeBR YhcBS3Q1+PAAuw7nZfYRp2MXOCMHz+bSuSwulyvgimGsBa4U2ztXzlVx1Vwd14htHEaWzDm3 hykEayvnWlmJawfhOQddhQWuyVwptx96UEfvgSvddCsXxXYKup07zB3hhrgTbD532rrEjdA8 Nwb26MB9485zF+GZ7WChMu6fbdU6blvnaWCGSdsjmJ8F6E812MuAoBOMwALDggmYYood5JaF dGumdaL9GtcoZAm52K/BZmC0hAKhWChlh4VyoQosFDPHOrAZHp1h24RtQi1hHeBnhWqoC/Md sWBSUmUZsGCoa06osw4KjdZRYY91itZBuQloz6rQCr/GuVah3TrJVHClfIXACw5BJiyoMZmw 30aYlSu3zdnmhG4hCjy3qHKdcFg4Qp4GTxKGrEvCCcxmoFeFE8JpYUQY4zMEYHSuVWUuwl1G 25JwUThMtwqXcUu4yzBP2HZauavcDLYfVZh+aPcUdx1zEncT5vg23Qizcxfsqhj4oJhbhrE+ zd2nq7gH3GNrA6/ngXesi3wqn9F+rf0anw0zeBrsZtXq5/P4Qn4bv52v4HfQ7ewCHnfrOF3O 1/Bm6yrfxO9lF/k28J4+IBiBdsDzFyA+3uV3gAebgLPa4YqTV/gAncWH+F6+nz9qDdJG/hh/ kj9jnePP8uf4C7SJvwS1mvgr/DXrPNS8wM9Cm0zQlhv8Lf4Of49f4degjdNQt9G6CiUf2pDN YO2zpQDbpIEvNYDdZMI9xWAr5bYcsN9lW751lC/klrllpp+7bV1g52xFthJbPoyDzlZmq7Tt ZKdttbYGW7OtxWaxsbZaug6OErtuc9v8UDrI93Mztoitj5ZtA7ZB23HbKb7fNszQJJv69L+v MP8NrTB55CRvNWTg/03GMoyo93Uo3XIaZARkDOQ8yEXLxRYQy2XL5ffm35u3XAWZscyQc9dB boLgc7dB7oLAfXtX9q5YlkHuW/AaVmdqMO2GZ6SSFQ0iKxodWcskkZxXT9YyW8gqxkBy3mSy ijGSVcwLZOXyIlm5pJCc10Ry3pdJzptK1iyvkNXKq4hKpVMdpE/kvUPLdkRZzHCsgGOT/pXa M5aa50FdHRzPAs59CC6oqGtVUXvpOXEFcG0TzKqok+F44/lQ1w3HWxruaLin4t0F9Vg3BDgB v1cAa8+ibgSODz8adecBF6FepMEASHkapG8b8G7aBmT+M5ADyN8ERZvUi1GyAWXPhwYY93cr ATs/BLUqGm6oeLfhOdEMaNkEFhUNMG/vss+HBpjbdyUNbg1+FQ331GP9bTjOAYKAyLNoABt4 t++j0bCm1TGgYRBwfANObYLhDRj9Z2AcMLEJJgFTm2B6A+aeD3V34ThvIf6xKeBa3TLgvlZu 8TmxBFjdBPNanY/huP582KWH46MnqNM9QbxMqnbMAGTDNeOTZyViV572fNNHY1chYNvT99el b0DWJsD3bodjLhwrtOOOzdvzYagrABRvglJA+Saoehq7ahL4O5FvY3yp8dgusyXOL7uaLE/z R8xOEudVG+/4GO1NGNu2p9sU55REDoj5sOZbOGbEbH535gabXlev76IBAsCpcgSOL7sC6nnc p10hQK/KrxY8X8CTu44CjqkxYNdJjd8fqva+C8Ykxs+7IKbtOqf2d9cFbRygTsyXuE4CXC/M 5y7gxV0wdrugDbtwvfe08dXGE99L4mQsht1JGGeox4zUOvA1M8QLc4rWro3ztGGO4jElNk+9 amw0p6ltM2cm3P9Q7Qv58zkt9sGfzTnaubMJuLAJNsbl2U1wIyG+JsTYOFYSsCG+xuPlvyRO 5liejoVFlicxMCHexTkLYN6pHSFumRs0HwP+MENMMkMMMkP8MbPaefBhHD+I39ao/mSGOGN2 q1xk9mt+oflBjBexbeF6MM8Rfor5SK/KW/j+OAdu9K0NfhXjl7hv9Wrtj2hz3vfkflIe/M0M sck8qLbbDDHJjGPQgsZJuA8Qg8yj2n0fxUEbeXyzMrE2b8LH8WvGJ/hQrvsoPs19Gs/wZCJX liZwZAIfkrK5WplydQwwR+8G+9ldpALnNni+cU6zu0Q7B7ZSXw2/MY9p+ctuyI3M6xqPwZzu xrYVUfmsHo89Hi8tJ9hdq3EZjv+DGs9h+4MYvRvq2w311UN7d4Pd7Ib6doOd7cZ1go3tDmr8 GePLUS03i+VN7ic8SurS6iBtjKh8Sdq1kYc3cHA8h4nxMO4nrgtfA5vaPZBwf5/WnzJ1vEjO BX3bPaidq0xA7SbYmAtaNoE2rhvzujiCCdiY18VytH9JbjZueTr/mrQ8ybsScyyLdu9Ewphs 9C3wP/O05Rm/Ms9Z4jmWGfv1gspFcb5aVO3avKTZU+w8LrOu2R8+Aq/Ua35XDz5Wb1KR6G/1 6SpH1Gep9llfsEkeA6gv1lCqgvAgrr9cO1Y98UHsE/UQ6+obE/wPytXvUf2tHmJ0fTuAV2NP DISPRtRxwn2udwBkrW7oR/1+rZ9a+XpY09VHAYcBRyyEi+qHALCGqz8NGFHjHwbhScgJ6scA 51U+rr+o2imOhfWXAVcBM9p4XQfcVNcJ9XfVcapfVsvXQ+yofwB4rOaAmP9j3NwAMaBhqwpc H4kzYNv/n70zj66qyBp9nTGR4UpjZAiBjmlE5iEgAtKgGKbcmytEUEQEGRuZjICIyBcGASON SGywEZmapjHGgIqATAGlmaSRqZlFOg000IBBIQLS5ObV/tXxteutfn98f7y13lrvLdb5Zbtr 1z5Vu3bVqTq5uUYrmbhH9R40mmTyLJpi4ijjGK0blDUOfLQwa3lU7xGjen8YlbVH78eieh8W 1fuqqN5PRQeZ+EaHBeuY7n80K/g5zuRDVO+FonoPFNXPiOjsf+ePrN2yH4jqvVBU74WiSwN9 sOZG9X4gWmD8yzyJ6hhF9R4guuVnufrTOeCnZ5SWo9uNTXSP0cmnMSpuq7jj/38a4/+ld2Vu fXe7/EbV3qM+UiouWV919NVQX6n6aqWvdj/7maavdH1109eT+uqjrwH6GqqvUfoaq68J+pqs rxn6mqWvt/U1X1+L9bVcX/nB9bG+1ulrs7626Wu3vvbp67C+TuqrSF/ng3te+d/8vKavW8El 9jGl4l2jjy+nr0pB264EP3Uf4qvoK0lfKUb/P3/W1Vdj09b4Fv/uc3wbfT2ir076ihg/8Znm fvG99NVXX4MC/TB9ZelrnPEbP1FfU/WVo6/Z+pqrrwX6WqqvFfoqCH6u/tnPn+zX62tL8HNp UG/Lz8q362uPvg7o66i+TunrzL9/SnziL+qr+L/x86dYlJg4/ncvxuDnVzdziX/Gqyiwvfi/ XLfN/3b+p58/1f/J712+vioE4631d1X+98+7qumrlvoo3CUcDfcI9w4/Fx7CNSI8Ojw+nB2e Fp4ZnhN+J7wwvCycF14VXhPeGP48vDO8N3xI/zsePh0+F74U/i58I3wnYkfiI6FIQiSRKzlS h/9uqP+lRlrpq10kLZIe6RZ5Mjwn0iecFxkQGRoZxTU2MiEyOTIjMivydmR+ZHFkeSQ/8rH+ 73WRzZFtkd2RfZHDkZORosj5yJXItcitSCzDzSiXUSmjSkZSRkpG3YzGGS0y2mQ8ktEpIyLl Wp+Z0Sujb8agjGEZWRnjMiZmTOXKyZidMfc/XgsylmasCI/IKAj+rdb//pO8Xv/bkrE9Y4+W DwT/jmac4jqj/13U/4ozSjJuR1XU56oQrayfCdX/4zcuqOAbF+L5xoVyfONCBb5xIcQ3LlTi Gxcq840LCXzjQhW+caEq37VQPZQcaqZqhJqH0lSj0MDQUNU+NCL0ouoYGht6RYVD2aFJqnto Wmi6eiKUG9qkeoYKQ1vU5NDu0GU1lW9fWPF/ccssq7KVxedVNsr/TT4lNbj0ypLSLrjSgiv9 Z7JcetakPBnIYtcnkAcE19Dg0qtuil51U/Sqm6JX3ZQZge2swF50b//sv+cHPxcH1/Kf3TM/ +O+PVYP0PfrfgfSj6afSz+h/F+GZ9GL9ryT9dliF/XAF8y99T7hyuFq4Vri21tbX+lrhpuGW 6WfCbcMd9JxkVqaX6HkZDT+nx+puvmlD8R0bNt+x4YRSQ6nKDXUMdVJeqGsoQ8XxfRsVQv1C A/Q4PB8armqGRofGqOTQhNB/qZTQ1NBrqk5oc2izqhvaGtqq6oWuhK6o+v+HvVuxZ9zHNHvr 7LBi5ZHLITdDbobc3O2i2cIbi34A+t8jz9JM9T5B7oJs6jZD7kbdJpqN0bdwR+FH6qbiv4/b XOg9I5998iZoOcHtIPRe0lyNzRK5bylyaSFtmIp+OHJz5ObILUxrA06AL2KjfZb+3W2gWRT0 qAGlz9Aqeuq2pl/P0/KhIjvHkeMpVdT6AM1I6obR3I3cnrov4+1uWtIeeti0xGaIZlPkpsip bhv0w5Bb4gE9bE5pKqUPuQ8LveG0pA2WIjd3rmFj4jALb5vxJmPRxM1Db9gKZmIzCJ/r8Kmj YXeXO9qNvOc0p3t6dtvjkNvD495ozWyxsWw4D3vaaSuhMwTLed5AzRX4/IVorGMiW9cpzcW+ I/ZvISfg7Toswv62+xett90dmpnuYbmLyNZVNEPcY5ptxUbdEFrp8EdYKHQcLLvip6fYW2fx kIe8ktLO2JdhXx/5PNwG12J/2X1BW0a8P2v5luSt7XtbtRwTvTXA26N5xtWZYCeKjbrsTdH8 QWidDzSaTip+EmESdQfDXFjVLaO0v5b3C+1TyJvhATjP7SNj5F+G62A+zIHFwrhq+l4tzAhi Od2X71AZgNweVgyYD3Og1K2K5XZKP0ZzHE02mqVm3EXWXAfzYQ4shmLfFcuJ1FKG3ruSFcjz aPkK5I1wRaDJhzmwGKbpvnzu5ZBFQ4Xc/Ri8Tt3cgOtgPsyB4iGXaLwlNs58+BZtvg6L8FMk bbYue3s1S+BlbxHMgv0gmeBd0R6qMl63sCyClwJOIQe2SW6gieEhhocYHmJkxRlKz6A5E2g2 ajr05T5vOzmzF2bBfvCgkEwoMjkmss408XYQ+bLe00sbtMZuE1D3xd4lWWonoUlCk8TsThLP mjvgRjKzQPdxgslPPM+BuUFdmRdjyPmq8n/i1vdaBLNgP7gDXoHi8xR1TxGNA3g7gDwPeUlA id4e2tk9TrxVNDSZhrzC0NvEyGYxjlJ6Hfmy/2uJsKG0SqHRZ1phIvoDjOwBNKuZI3VgMqtQ M9a36X5dzUnoL7AWlSC/LU8Q6x+saRXNeiiWVjnvN5r3sJpNg1WJxipsGjIXjiB3h3nBGqif Lxb+7Tihf1BG3/+tRMNjLXWfk5j460X2G4rsXCS388iTVLJ3L7XWe6ulrruKVknpMLOe+7Jy NhDquXmYOXWYeSSz437kXEr/EfRxDO0ZQt0Psf+QOLPCeBclPkK9VgvNeDXy9fPRHod9ReTt 2GcHq0c+60COPB2Yg0PQz4O/gPdzl2OwLK6LjGZcAfeV0o4yynrmipwQUHw+GKzJi7VcjZw8 iCYZnvRryPiy3i4hn59i3V4jq6h3iJw8IJZeXXIvXjR67CSHE2Q9t/aaWazPyvqJwLgckgjr dWAjObaRWWm4g/myEe7gCSJrdaLU1fHcSq0pzKAp5KHc5SVpldNVSp2uZlVx9V7Fqskc70Ct 9f5N1gexbyWt1ZksmvMy03WGH5EnCy1PDdafKVjKXZbDXLjNf0Bk/01m7uPylGHmnqJ0c0Az Q0Xu4Teg9AqaK7RfItzSPyhrHa1dJE9D6yueiYm0thT9J8S8JnIyfTkjOyW7myv+97khzYuy e7SrC/V4TWFVkVFbQB8Xy1xzmvEcrCd0kl2tsb/E83tYXsfz35D/htwZ/3sl8priOZ02jxKq j5Evwae8ckr2FeL/YUaqPh72meev7KP0PqE/q59k+Ex2L5fcYfRC8u1XlC6g5Qe5VyHeEqWn 7l8lGh4xcW8yvuPk+e5UEW/OEZHdh5E70d9ienGTteImMzGRdrLa25ulhU4L+n5X0FppSQpy Q1fvXa1d9PozV+8GrUdo227qku12G3eEzHFq9ZA9sN3D+VZzrttRe27HOK5xB0l+2u9p+TDe LgQUb0vw8yA+U11X86xQZ11NJbsyHQEnjji8T63RcA45cNGV6K3CQ134e/xEkV+i74uIcwf6 OIxaF+Ap+LxETO+ypBdTZdeq5bskK3gGjcTbANrZAz++946sAEE2Su820Z7bfm2hdx0egYXo U2C6rAlmzymWdlPYxjvGc0TkTmYXip+DcBd+duFnF36+xn4I9kNEY2ehaYsmanatIqsb0hLN I7AQfQqy2Fc0O1vuUmjIPqorfrpKXbsnck8jix/NQvQpsCaaJPKH/QY+z+KtBObBlbDAlSdg Z3x2xmdnfHbGZ2d8diZKncWzU18snfpEYBsetiGvRV4rvdBRXUz7hZ+a/oqs27YYP4updR0P omlFO28G3MPMkjZkek2YrTI6U1zZbX4enA7kLjvco8xZTgdiqcxO/hx7++qcArrAL/FWHf83 4FFYQN1esBN116O/APe6Okv9FOmXny90h4mNu8/boGc69/JHe/Kc6kOssojAj9iHJKp+PvO6 Ga09SJ6chXOCc8oxRmcnOXmMUTtGZMhPmWU6AnVkpLyqmgs5E9lY1sLyIPI07t7W5Btj8YFo HIeRctB3xf4svAnz4E528nn+ee4imjIZFz2+Ip8PyFgjrzeZIxqdCemMYDojrs/RaprzV32u jHrlhb4+t5bul5lYut/To+y8x05pj8TEbS3PHXewyM4n8Hfo82Q/5i5hVcRe741lX/RL6obZ Fw3H8gs5b7q7ZJV2OD86PeW87Fai9FNq/UkYVwN9FTzcgQXYP0eeZMtYOGslts5p5M6wudBN ljFyU8iNHOy3klEnhN5ybJqTFYli6bzByH6LPIzSepRWI1vS8GDOqgWwC/dqz65gCU/AThIx 5yxPkBzWxu08NXbK/sRZyo50Ns+gZewPJ6KZzq6mGD9b4GF4BJ7Azzm4D77Ms+kEz9n1Qu8L 5Gy4gdX1Bs+g12X/5jZgF3cikNfBfJgDi6VUTl7eJeLfFcsKsLX/tKY5kXFCdDYEzIc5UDx8 guV4aq0VjaZouonG60tW9GGv+zIMwyx2hqPZf3biTMoO1q1D/mziXlg6ObKWumg0pRcX8Xx/ wHUwH+ZA7c2rJ2dSfys5s8uromuVx9tSOBByPnUT6PsryOsCroP5MIdS6dcrEiu3UOS4mv67 sJf4p5YbUOLDGcEpkDg47dn1TQy4CGbBfpBckp2bX45xfxbLTrI2evd7u7R81ftC8130RwNm wX5wB2wi+UbpTjQ70bwhe13nI5mh1n+xl64Ffw1fZm+ZzDmoNXvXhuyKZ5NRL5Oxs2UfaHfC 86fIr3B6XUPbvkH/jfhxw7T/tGjcGgEXwSzYD8r8ekBa5f5SzrD++ybnZUbY5/BWHi5lhzCZ eZTA/uFF8n8hpScCLoJZsB/cgY2Op3uf3MX7Qt4raorNBmptQE4gAjeI0kkvn7lQS0oNObGe lxOre1E0XqG0xF2HfBXZJU9c7Cd6lxkFQzm97pfTq46GZMU+dzJtk4xVyBto+QZKzSraDpb3 EjSVjJdX3e+u5WWi9+4jk7+BrwRrqaw8m1lLc7GZif0HzLhvmUflWVFbsQIvQN4kK7DOK13L +5xx2YlPTq/O23geibcGyOvk/KtPuFKaheVmYXyhZHi84rT1ezzzziTOrPZ/4XSTwwy9xAxa y+x4EHI6dlbi4X28KXe6rrUZP59J21zeU7mciPVYyDN0MGfhMSJrD8XwMPO6GB5mthbDw7T2 Uy2/yR3XE6U7sgdw3mN12gVd2rZJzsjuH+FYocObE2ePP0Oed8ziXOS12C+h7pvM9BzR+ENl NfCHo/8C+yLYEy71bwjjesuTDps/SebE1UCuApvj7Q72c2lzOXk6uJXlPZXbxEskf0S2pW3e FRl9tzJzZ6I5b5IPBd5uyRPRu2eDM7W8scznjNOaed1ZnhFxXRi7I4zUwyL75byKuvQWz6wN ciLW2StrQpqUxnXhybJUZpNerzbCHaxLG6E8Q9N5j9QA/Wn0p9FfRX8O/Qn0ffD2DXcxJ6+J PBkPww1yX69IeuTzPtZZzYl7Gc+4+WJv/1nO13qV60eEb9JmWZday1nbr8isL2Z2bxHqSO5l nWlCS4T7KC3Pvqi87Hz0eljKXFjEiiGl2TAnWD2k1jHWja1y7tY2C9AvoP2sV/4kLa+jzR3d Gpp/ELrJxP9jevo1ozMOm6cCS9HU4hz0pfTR/YWckR3eKjvm1HacU9tu1uRXiUMS496Ic9m7 ZEs1T69Ffjy1brJD+EjO494wV58s3NmssaOoO4q6s5Dz5F72Q9xxAOOyhFP/IHr0Oifcw8wI F82bcip3G9DOZ7D/jjvSKm8a8kQ5mzsvIBubkXhoCZ+V/ZLeN8qs3OBWlecCLbxAnpvT9KNk Qmf63sTZrPvVW/z4Y+EEobvUXcnKKTPiMZG98d54WiXx7IGN+X1HIauZJ6XOGHmKeRZ+KhH/ DbTwT3Ludk4iX5XTutMMubOc1p0P6cvd0hKPGeQ+5VbXmsW0f7JzVXOSozPBvSS/5fH/yJ6w v5zWde+kPTXkzO7MxOeYgBLDivApOad7G+DTco5w/iV996sQgXTO4Geo9Zyc0517kbdQWkJ7 /kkLV6P/nt9lJEtk/LrcvR3sR39HwJbB3lKeqtWptVdO7vZf5eTuvE58qvP+sIgW9ofpjM4b jGNYRk1nr6a9Ek0S7VzAKSYXtjcyJ5Rc5louJ51cOVXpUn0S8R5gR/05lq/Btd501kORQzBs iIcwHsJ46IxlMWe9BqJxG6A5hmaBq0fcoq5dG87gvPwE5+UnOIW15nz3rpyVdCZoe3solie4 YxX2n43w1kjqumnIUwzRTBFvmoXoU2BNnuw6Mt5BejfM1adCZyE+W+Pf9K4dfFXOnrr99AKf DfDZgJ4W09NiiZX7lHj207xD8DXJIjx8bEh8BiB3IQ7t/QixEj7O+f2knN91LyLy7ss9yH0j zKCv8XAdbxF5Wkmr9MojfM+9X7OvO1Xrx7Oicl7W52spfQMmoWnnTtNylitta4SG9datyVh8 C78XOnuE3j6h2whOkbpeY+5yLz67wjZwOd5yTKzwcBXWJcKvwJGy4sXtkgjER4nnLc59w3lL P1LkOJ+nXn8p9R4gwnuwTEMeLHLcLvEWH5WdiRfjPNiafpncaMUopzEuC5ET8NAWmw/l/YDz nMTfTWQUPiY37pOnmHNeeuesRK6EnI3NadiIWikwgdGsInW9ZTLi3nL0zbF8n1F+Q2T7WzSt /ZZwruQbltVlNHWeTGcNFB7AZwHy/bQ5gRi+KnpteYvW3mKG8pv6sg+UpZyyL5FXyu+yYWrZ +8j1YI78ljwo/QAuw34CsmE1mIve1F2FvApvBfAbNN8gH8dG6+3uZfJGtBGcDsfB9vA4zBZa tlCVoEmFSugMQZ4HV8BfBLL81uAYda+jyYUdqfUWcgKlRfA2Gu5iZ6K5imz8t+XuN+AJSn+E hXhzsOkKe6I/G8jShjw0K9F0Ri6jVn3k83AbXAsvYxlBvoXsI8dgNXgmVl92hrQHe/WDaBwT mSSYKBqLXltPwf3oTyFvhgewMdHrHntUe2hhxkJkuz1cDJeaUUBOhQrOgytisjv93MRfNNZH 8DqlX+F5vukdclUTeWxi2Nxn+oKmiFadRz4Y9OVR+hWv606g7kTRKOJjTcIyNRalFwto+QJa u4C2CXPRXIeX0dwnVEZOgonwHHesA5NhM3iBe5kMfBv5HzAx1kGzB/I9jOw0k5Oit1chN4zJ 6fsIchv0ZIUdJ/TJNP9lobsBD6USAX+kyN4exnqFiUzZe/LbRux/a3IDb2/ThpvY/Eisusus 1HOqGvkvnGNGufSazDh6Oi6gDZM1q8L2MJvSbLxli0bHU/Sd0KdCFTBZngvI8wKKZZRoHwsi n8woLIYidxS98xalJdR6kBaaDC+hR8TfOmlGhJ4uMfmMPAibNUTpkFk9JFbuYSJm5m8CchKR 2Yb9ttgj8lYKeRx+XkJeJHSYxU5XMvAWccullNG0aqK/LDG07tBmn+gl0qN4ohQT6rwysvSR WFm/hSYP+wdMpu5i/Ij9fnweovQDSDzVd/T6ElwEvyq7R7OUPpZD8wlyTeRkRq0b8j5afpHS 6iLrFSNPax6hdAxcQOliIkC2O82QzUxPlIjZ9dCbGfElfA/Pg/EwGM9HgyiJbFa2vczr7czW C4wCq4rlEvmH8WNWwn3wn2XNJZLIe8waiOVMLH9l1kDuchA9s8+dzNzZhXyzrLNup3mOLGO1 OSKxch9G7oS+GD83kVkJ7btgA5hi5iw2u+Bnwer0oCZPCms3NmvMjIasAPZcotQOm8PQrBvk rc1zQUdVnykc5r71PhwNzVpRF/4evoR+LHIHOIwMfAX9B8GzQPJ5aiBLBMyzow/2rCH2APNM YTR94l8N5sL9cDNkPbc+YbzKkDfB29Q9YMYLmUhaV5GHwChRuoFckdJC5K6wZ+yGtBD9WXzO gSthQTB/zb0k83eR+TeYET1hZ/TbkFthPwVvPHesHdw9Rm7wZLRYyZ3qWBaSLcjWDVbjo8gF 6Hshm3WV0ffzyahK8DVWGPYnfi28mRWpJ61dW7ZQfseEh7LYb+mvprUT3mYdzmQlWQn7Ynmb dbgCfTHPqYRgXU0mt2VlaIumLdFry6pyA31F4lAYUNZeB8uuAcVDHqUrAybz3BlBDJNpp6xL yZTuhWup2413jCW8w0/iTWOS/6m2rBB8ukY+ndKKz+SU8m65nnzK0dovtPP5/e8Ozp68obL+ 4concz7nRMZvW+w0v7zMdH6Ds09k+wvka+5xzqr8zkv256q3XUfGRd5IOPXd5+Xu7h9ljyGy Xex+L9kodK65K5S8X9KW6pTQGkqtLkIvn3caPmzsTpS5iYc8V+97nT54uCOlfg9qZcIWfD7h Fox3E2XEnVclYs52sRHZnix/4WKPEDpZzmm8aUu1W2ilmFpoDgndK0LdC+Ey503pBX7S5K2C vdP4obSX0JuKh1vwNJwJVzvyPqe+0N7syOk+Wc719i00lb3etFM+RVZBNOqQyOqUUNuLvFvs vbb4SaZWU0c+v1fHmS+j7yyjbQXyTptaq2EbNHXF3ttCrXNBS6S0F5rFzgRZbdC3CyifI3ID b8skSrRtnchWEe1xbEvolci33iDbti0aawul8gnk5tYZPjErn2rrZs/UbCRvXezN9luy6tqv S8vtP8m8FtmeYc/QzLblt9u22Fu5MFPoDMdmns1nHe05mk2cNzQ/QW7ovI8fLVvXsaSu3ZG6 byHfg7frkqXW37j7bfsemcu2ZEUvuxrtrCT5b/NbftvXmkftu2Uu2w/IXBZ7Kwq7C9UPQsfB Qxe89bSry5pp78enyDfss/LUQC7AMoKHGHV/iXwefmFJhNfQhkvWr7RlY0vecOp1UWvuWPJb 5lKrRJ4FdlNZV+3J/NZevln2slUk7RFaj9pVRGOvlyeX9Q955sIk2FiovWmqs8hzYGXrNJan ZaYjn7ImyNMEn/ut5Zpzra/leSQtURfw8IO0xL6jlHwK3f1O6Ccg/x25Ip9OL4/8EPqP0Gg/ 7h987dPtDdPgFaFzEa4UehXQ3xHaLnwTTV1snhX6x7CsDyOUpiAPQO6F5Xk06N2ZwrhayA9Q uhWWoOEuzl+QByNPht3QTIXjhRattdtR+iVyEe3xscmF+ZTuQP4E+Vv4OHwaPT1ySqlrvO2F r8Hn4REsWyDTL+df3PFF5O205yi8hOaPeBtErVZY7kF/H/Iq5EXEZD3yy3AJrEetP8Tpp49f w4yOyO4VWGbGSGSvApo7yI+YMULzthkpkZ1n4QCYhbe+ZryoFWdGDZmY+FfNqGG/Ep6nNEUY VwvNVtrWBMtZcJiJD3d/jBZ+bmIiGv1MFNlEjDi7y2Bb7ki0re8pJZL2ZjyQdd5cuBP7pfAQ zID02jWZtoh2ZmN/Px6IuReiDeSPXYfcuwv7c9h8iNweS5NjHWBIGP+h1I2/l3Y62HTGw2cw AX0Nel2XyOzBfh6lzBH3MLVqcy9i68w1844YHqMusXVnwgfw8yk2TfFPPO1HqbsGPbPMM7k6 lHuZmVjL5B5+vkLG0n6DWpex+R00GUL0nNEmk7nvfcRqldD6Hs173Mvk4YPwYdidugeQm+Mh FV6AP6Kfwb0GIj+BH/rlcXevJZaz8TMfmcjbrA/ucjgO9sTG3PGv0GTIJkqHQ8bFqc4dX4BE Pg6Ne507TkBv1jTmoGtmNzPXuxtNZcjK4JAVDt5ss1KxqtjfYU9ddyz8AOahN2sjsrMfzS7k 09ydvHKYO/Y1apF1nplNpkeF2JTDfiEaM+5b0GfCREibHdZMPwefplVkhfs1ZE655IZFy/1J 1HoV+9vIzER3IjyOnjF1iL/XBz1rlMuq5ZIPNqu6OwRuxL6EnJlM/pj1Kh+yFnnMI+c1NGbl LKauGVPG3WGkfHLJeQYy15w5kOyN2yeMJys8nl8e2e4T7Tj67lPqYu+wRjmt4eNyd6XkDOL+ ISa/LeoN0+AVoXMRrhR6FdDfEdoufBNNXWyeFfrHsKwPI5SmIA9A7oXleTTo3ZnCuFrID1C6 FZag4S7OX5AHI0+G3dBMheOFFq2121H6JXIR7fGxyYX5lO5A/gT5W/g4fBo9PXJKqWu87YWv wefhESxbINMv51/c8UXk7bTnKLyE5o94G0StVljuQX8f8irkRcRkPfLLcAmsR90a1C3D5hHk tynNQu6LPg7SF/8qbELpLDgMPkatz7lvEi00Lae/7jLYlrr02vqeUnpkb6Yuo+/NhTuxXwoP wQxoWmhG3PQrG96PB/ruhfDJONp1yIG7sD+HzYfI7bE0Y90BUiue0vh7aaeDTWc8fAYTKJ2H TGa6h7GpjWci49B+51NKm+KHyNiPol+Dnuz1TA4MxZvJcJOrX6HHxn4DzWVKfwcZHZs4OKPh e3gz4/ggfBh2p/QAcnNqpcIL8Ef0M/A5EPkJ/NByj7t4LbGcjZ/5yMTKZma5y+E42BMbc8e/ QjOmmygdDomkU507vgCJXhwa9zp3nIDerAZkr2vmBTnv3Y2mMmROOYyjgzfbzHHmo/0d9tR1 x8IPYB56s6ogO/vR7EI+zd3JBIcMt69RizzxTM6bHhViUw77hWjMyG5BnwkTIW12WG38HHya VjHu7teQWeAy+hYt9ydR61XsbyMzd9yJ8Dh6xtQh/l4f9Mxul0ywWQndIXAjNmS1a1aSYmQz UoymQ/x9MsR5BpLzzhxI7sXtI/8Za4/13CNXfWIYR498Sl3sHdYHp7VQfW2fUPJWZJ8urW3e YziztaYL5+4h8rbBWcabhK6ULpa/jXWS5fNpznzepdiisf+Jfrbo5QMWSv7aQjR9hN4hodsY fQl1syi9KPRHIw+BXfBWbCy5b6/gbUZtJe8o5Gy4GM304I1HY/62Tt6ipPP+5DbvQxJ4N1KA frnUtQ+gGULpO8g2HorhOJhH3ysI7clEoIe8IbF38taiBXIL5zOpKzaqjPcV9wTvTzTV38XG S8VPJrXSeEPSRjTWPe5Cra8SvBsp4B1IAe9DNGNvl8l7qm5l+2TtRe4lZ1v7gMhWR+TelKYh FyIfx3IicjxyG0r/TK1LaCobb2jOxOSk3xCbytRqCgdQetSQ0kTk25S+i4fa6P+EviVyfUp9 5N8gv27aILJ1wrSB0vEixzLLbuhMqINmtaqueRJ5scjO3Zzly4ROO3gNzW3k+Vj+TegdEroW ehsWUBovtEqQi2FT7BU2s2F9OI3ScbRhLvIA5DzueBmbCci7KR2Bn3L43waXBy2XlgxDsx7N ZjgT0lOnC6UhNJNjm/i/sIvnLTF5E5iM51FBG0R/SsbIaSdUp6i7Cs7BG2887HNoeoiNWycm n1VrT+mjsfc1Yyqi9ZWwaSYa+zvTZjwvkzb4NdEUimzNQZ8Z+0TyU+zd7ZQelVLddxmdCnjO RF8Nn2/R/hplt3U7p9LaH2jbSanlZdGX8+iXknXZUstqyb0mIKfgp2nsDr9BuCPxhDOFejcl LEKThM155MpC5zFa1YJR28m9xuN5CC0sEvousa1rMqSsp2Sd2NiVRSPfv6NXSGaZW0n64lfD /rzIXidsKqDpbfKQaCdxlwpEprJEzJpBr3vF5N3sCFqYh1wu9pTkWEzedt4Do9x9J9HoiDxA LK0SajVFvoHlTjzMQZ6F/ijR2Iu+DprrlOaiOYm3XDTtsbwq1CsO42XykPZH6MvfaUMRmWAy ea70Wp8CThMlxh1OZqRKsI/hoTH3akNpU/KnCH0roV7fZVy6BjbCc+TAITwfMPEPoiEtT6Mv RcSqCvqKsBeWI4L73mFe3CH3rpEJxlLiVktkndvXyGSx6QvnoHkKy0TulYjlPmrtxGYBXE9p NJi/qbovPm1eQx+/Qp8Et9KeocaS/o4yvRZLnUW8tSaj/CCqy8hqoiGRsYbi+R3WgS1Eb1tw L/GTykhVMSsVtYqptQ3LGNneFMs1ZGaCyH6KuptM28SIS/sXmhkdzBHx1ocxqg2fo4VXghWv Os8aucveYM7O16Ufm7ks3vRq+Q6tSqWWWVfF8zTeEherQeTVIHmml3XX8pNk3SVsWAccM49m UTdq/4XM38RoSh8/N2sjlpPQ9yDyc4V6XdrEWiGrihmRPBhPaTK97kB/T8PZ8A6e0xivR2AK TA9sZJXLDsZRVrbfyZqp82ETs+l9suIOv8m9Q67eIZ/vMBYi3yJuk4OnWHU00usF9LSteYqx 5hQzOpuFcWRRHE8Z5yKWgyDPOPWd5KHeA3/DGniNNVBWmB60sw1Z2pQcPkBWsxZpy2VYiv1H 6Edg2QU5jH45LT+KXIC+U+wwzGL2XZM9udwlNr/sDOOVKbOVMc2gXynmuRb7M7+vv1daS8un 0pdkLDNj7Hmom6RqaZ+JwchquXSleFaK73lTrvydTvCmUajKoS8neqVEE3tGPmUd6y2fhI/x 9yCxcsjNkJshN5fPacdayGfptT4LfT5yP/n8mHwyX8s7kIuRr4gsf8Wj626Ub7lB30I+Daj9 fMh3s/zA99tsFsrfESglf+ceS5C/5oglyN+DxFb7I+RbbuKmyLfciFxaKHJsqv+WfMtN3Hfi 3z8njLuK/LX4j7uI/C9kY9MdNseyPxwk33sjbSstMm32f4/9MmRT6xJtLkFfG30lYdwj9K4x vEp/p1G6BsahfwjLDtzrCvo9+ExF04bIGM1tSp/BfiZ33EOUbsNJ3P1RLBtQVyybIjdFTvV3 o7+F3AA/Rl+HljyJXA/5afwcE8bHIfNNPvHxlD6D5g28bZDvwMHDQ3hohtwMubn8vby2P4hc Bd5LrY60OZU2D2CUF9HTHyilbf4KNP3gDlhCaVXNJnEfIX+Mzy3Is7D5FP4O/RrkQ8jXpYXy LRy6tZKHzfm9vFNahkzc5DfpsWal/5T2lDIW8pt3rbkmpaWFEkmjiU2CyZBaeGhWuh1L6pbS 69JFyOfw+Wfko8jFlJJRpSfQXMCPfAJHqXJWTvwl5Qx8ZfQIlfCb0YOHq+wR/ceOUquVPvk9 kdkhWemTRVmZuldVUL5KUr9SlVVj9aBqrR5R6eop9az20V29qqaogep59YJ6Sb0e2FdUcaqm qq3uUU1US+3lURVWvVRffddMNVFN1SvHMJWlxqkc/h+Dpk5Ixes1436VoJqqh9TDqoNenZ9W /ZStnlD/pV5Tg9Vw9aJ6Wb2hqiina7duXVR65uMZyWpAj8xwspqPl6p8Z+gv9dpcR3tsptqq x1RnlaF6q+eUo+qrHipbTVND1Ag1Wo1XM6lzl0pWDyh50v1apamoaqB+i76aqqTjcJ9KVHW1 3+aqlWqnOqou6nH1jOqv291Q9VST1HT1GzVSjVGvqFlBC36hyqsUVUPV0x5aqPaqk+qquqk+ aoDyVCP1pJqsZqihapQaqybId5kOTB0z0HkS9oVD4Cg4DmYP7D9irDMDzoEL4HK4Cq4f2H/M YGcb3A33wcPwJCwaOHBklnMelghdG1aCtWBD2GbQiOd/43aCEZg5aNQLI91esC8cBIfBLDgO Thwyuv9AdyqcBd+BS2E+XAO3aMf93d1wHzwMT44Y9dJItwieh1fgNXgLxoSeO+KFgSO8crAS rAZr6cLRXm1YHzaFLWFb2AF2eUH8RGEP2Bs+B4fAEXD0C6MHjfLGw2w4LUv0M+Ec+A5cCJfB PLhqjB4jbw3cCLfB3XAfPDrm+VFDvFPwDLwIi2EJvD1m5MAsX8FyMAHWgnVh6pgxTZv5bWEa jMAesM//YO874KwolnerumdOnzMzp3ZZFliWIDmHXUQkCQqIJEliQkHJQRSEBdQLoggSxISA 5CQgIGJCUBQkB0VFRHJQyUlyTq+mdsTdlfsX9d733u896R9V3TNzZru/rq76uieJbM2yTKiT yBSRvUT2EzlE5DCWN4fGipwicpbIOSI/F7mMZdnQGpHrRG4SuUPkbpEHu3Vv2S10TOQZkZd8 aZTIsEjq1r1LNxMvMlFkHpGFRJYQWSaFkTTlRVYRWUNkHZENRd4n0mfjin1P/J/Qmsd5Dsj5 l3IoLw79n6XNHsNmL2og/B8rWVJKzSN7vYwyeoNSs59z5Z3LfyeH7L2vL+NuWCrpEcVn9Uuy 2uPHB58l3rDMdMMy1+9k7A3LPFJTLRrTSL8FabfRH0rNkSorJPzJXDbJKY5P+f6Uzg8F/pQu CIX+hEaOpH8s/xgT5Aj+xzLmhmQys40UjvrDYArMgWWwHnbDKbQwHgtgWayBTbA1pmA/HIZT cA4uw/W4G08pS+VW9dQzarAarWaq+epLtUUdVBe0oxN1MV1R19FNdUf9jB6sR+uZPAb9vxVO tVldP0O5ZYbykAzlV9KUrQz7QzzMN4HBNGWnbPqyNzn97+lM+vPHN01fzgLpz58lPkO5UIbj a2UoP5yhnKE9WbakL2ctkqHcMEP5qfT1zzkx/f5cn6cvFyyRoVwqTZnHX8GkDPv7Slmxf4hL bWHhhqm6SGrLLba5rOyrCgVb1wZ6S6B3B/rY9Y4u9mGgPw/0ikCvS1+L4pS+lcXnpy+X7pv+ +NLb0peT16Qvl5mbofxJ+vLNTTKU78tQ7pKh3DVDeUQaK+NMuZEZyvPTH18uQy/9bv83Gcpr M5TXpe/FCt+wJEamFQ6HtjhWvG1LTsAjdRigHWtnklgRByGvNq3watEyWkRLeEsIj+ARPu4Y HgPEE3gCFJ7G06DpDroDLKpO1Tlu+vag9J26lv/3VJzKwlv8J4jIr4+O8i9LcTkrz0a6wlhY AT/CBYznOoS5VvFeI1BeLa8xy9rePSzrcO1j2Sfn4dlCEs95KtN+0CqW63RA9ArimZbKwuVD olfQBlBc2sRyBW1huYrb6ltoIuSjH7mui3jvT6JX0M+sl3B5l+gVaY7cHRy5Jzhyb3DkvuDI X+tbV+pbT+p7t9T31z31ZU8D2dMw7R76Umq4Rmr4jdTw1z1rZc862bNe9igwihMPM1f5d27H qlhGNQujqr2a3l2M+iJaBCGu0xJGSvMR/tXI1KjPQ4t/30L6C6SnEC/gBe61q3iV0bIV8x45 ry3nDcl5jUpUiRBW+VQ+iKgiqgg4uhb3pmu3tFuCZ7e2W0PUbmu3BbLb2+0hxu5qd4VYO8VO gUx2D7sHxFEeygOZKR/l4zYVoAKQhQpRIchKRYjnfFSMikEClaASkJ1KUSlIpCRKkvdy3ww5 6Ra6BXLRrXQr5KYKVAFuokpUCfLQbXQb5KWqVJV7x7e3/GJvBeguugsKUjNqBoWoFbWCwtSG 2kARakftoCh1ok5QjJ6gJ9hRdKEuUIJSKAVKUg/qAaXoKXoKStOz9Cwk0XP0HCRTP+oHZWgA DYCbaRANgrI0hIbALfQKvQLl6HV6HW6lN+gNKE/DaThUoDfpTahIo2gUVKIxNIbtcxyNg9to Ak2AKjSJJkFVeovegttpKk2FO+htehuq0QyaAdXpHXoHatC79C7cSe/T+1CTPqQP4S6aQ3Og Fs2luVCbPqFPoA7Np/lQlxbQAqgn/X239Hd9tpVl0IBtZQU0pFVsLY3oS7auxrSGrese+oat qwmtZau6l9axVd1H69mq7qcNPEYeoE08Rh6kLTxGmtIO2gEPyTuxH6ajdBSa0XE6Ds3pJJ2E R+g0nQb/Pd99eXz0ZUuKwRjog4mYC56TL6P2w6b4MPTHTvg4DJSvoQ7GJzEFXsLBOBhexZE4 Cl7D43gchuIZPANv4EW8CMN8JwPDVUiFYITylAdvqkwqE4xUWVVWGKVyqBwwWuVX+WGMKqqK wliVpBrCOJWiusNC1VP1hEXMI56Bxaq3ehaWqH6qHyxTA9QAWK6GqWGwQr2p3oSVaoraCKt0 lP3PJV1Wl4UrupquAVd1bV0blR6nx6G2UqxJaNmt7FZYxm5jt8Gb7XZ2Oyxrd7A74C12N7sb lrO7293xVrun3RPL29+HBmIF5x6nBR51BriIV7xY7071tPeQN169F20d7ahORvtEh6gLpCis w5SX8uoYyk/5dSwVpII6ExWmwjqOilJRnZmKU3EdTyWppM5Cpam0zkrJlKyzUVkqqxOoHJXT 2ak8ldeJVJEq6hxUmSrrnFSFquhcdDvdrnNTNaqmb6IaVEPnoVpUS+el5tRc5/M/Tq3zU1tq qwtQe2qvC9Lj9LguRJ2psy5MT9KTugh1p+66KPWknroYPU1P6+LUh/roEvQ8Pa9LUn/qr0vR QBqoS9NgGqyT6GV6WSfTq/SqLkNDaai+mYbRMF2WRtAIfQuNpJG6HI2m0fpWGktjdXkaT+N1 BZpIE3VFmkyTdSWaQlN0ZZpG0/RtNJ2m6yo0k2bqqjSLZunbaTbN1nfQB/SBrkYf0Ue6On1M H+saNI/m6TvpU/pU16TP6DN9Fy2khboWLabFujYtpaW6Di2n5bouraSVuh6tptX6bvqKvtL1 6Wv6Wjegb+lb3ZC+o+90I/qevteN6Qf6Qd9DG2mjbkKbabO+l7bSVn0f7aSd+n46Qkf0A3SM jukH6QSd0E3pFJ3SD9EZOqsfDuZSPvMpK762KJuzjc2wGW9ug20ArXnWPFChy6HLoMNVwlV4 9PxnvDFb7j/e+P9zb/yb9SWK9RXz2RZ2CG39x8b+sbH/kI2h3ZH5fCzmU2V1TesByAkVoRrU gcbQlOcLHZm/P8N8YDAMhdEwGWbChzAflsCXsA62wM9wEE4wswcMoRd5CnSkWyQl8rTo7pFn RPeI/Et0z0hv1imce1Z0SqSP6O6R50T3iDwvumfkBdbd+bh+olMi/UV3j7woukdkgOiekUGs e/Bxg0WnRF4S3T0yRHSPyMuie0ZeZd2Tj3tNdErkddHdI0NF94i8IbpnpBco3tuXZffIQJY9 Iq+w7Pk3EBkuLe8WGREg82aAzMgAmVEBMqMDZMYEiIwNEBkXIDIhQGRigMikAJHJASJvBYhM DRCZFiDydoDI9ACRGQEi7wSIzAoQeTdAZHaAyHsBIsO4/d0i4wWRKYLIzL+JyAcBIh8GiHwU IDInQOTjAJF5ASKfBLbyaYDM/ACZzwJkPg+QWRAgszBA5IsAkcUBIksCRJYGiCwLEFkeILIy QGRVgMjqAJEvA0S+ChB5XxCZK5aySBBZ8TcR+TpA5JsAkW8DRNYGiHwXIPJ9gMj6AJEfAkQ2 BIhsDBDZHCCyJUBka2Ar2wJktgfI7AiQ2Rkg82OAzE8BIrsCRHYHiOwJENkbILIvQGSNILJO ENkklvLz30TkQIDIwQCRQwEihwNEjgSIHA0QORYgcjxA5ESAyMkAkdMBImcCRM4GiJwLEDkf IHIxQORSgMjlAJErga1cTUXGgVRkHExFxlGpyDg6QGa/IPKLIHJKELngW4r/nUa/3rKa9gAU xXVqgq6nG+i2up3uqB/T3XR33VM/rXvrgXqQHqxf0kP0yzx3+Vnv0rv1Hr1X79P79QF9UB/S h/UR/Ys+qo/p4/qEPqlP6dPRcv53lHAtruU/MN5/OlfX1XVB6fq6PmjdWrcBS7fXHSCku+qu ENYpOgUiuofuwUzgKf0UuLqX7gWefla/AFE9Ro+BzHq+/hrio7dEb5FVhkRwrNzWTVYeK6+V z8pvFbAKWoWswn7LuEanZXUdISHN2kRxWQ/q5B/BvywcHJEzzREl0uxjJHUnPhqseMt/F1gR qwi4wd+Nt7JYWa1sVoKV3Ur0333HR/z2dxUUgBgrzsps2VbIMlbYiliO5VqeFbXIirFiLX+9 y+K29eEq+L9R1m1WFfCsO6w7gHhfOUjQ0/R0PUu/p5fp5XqFXqlX6dX6S/2VXqO/vh7i/mqZ nqqn8hnf9p9r1u/odxjv2Zr9KCO3lP/ez/rQtbNP5aPe4b3z9Wf6c71AL9Rf6EV6sV6il16v j+Xs0/Q0Pvt0Pd2/I1PP4rO/p9k7cw2/5rP77fDPXgrir3vW67RDMPs5wMz/3Q1al/zOtwb+ nf2EmgMvQD/oDy/CABgIg3hcvwRD5Ouir8Jr8DqP8jdgGAyHEfAmjIRRPObHwFgYB+NhAkyE SewB3oIpMBWmwdswHWawP3gHZsG7MBveg/fhA/YOH8Ec+Bjmwjz4BD5lX/EZfA4LYCF8AYtg MXuOpbAMlsMKWAmrYDX7ka9gDXwN38C3sBa+Y6/yPayHH2ADbIRNsJl9zFbYBtthB+yEH+En 9ji7YDfsgb2wD/bDAfY/h+AwHIFf4Cgcg+PsjU7CKTgNZ+AsnIPzcAEuwiW4DFfgKhs0qkaq sbpHNVH3qvvU/eoB9aBqqh5SD6tmqrl6RD2qWqiWqpVqrdqotqqdaq86qI7qMdVJPa6eUJ1V F/Wkmqg2qc1qi9qqtqntaofaqX5UP6mf1S61W+1Re9U+tV8dUAfVIXVYO+qI+kW76qg6po6r E+qkOqVOqzPqrDqnzqsL6qK6pC6rK+oquyD/bnutLW3rkDY6rCO6kW6s79FN9MO6mX5Ut9CP 6yd1P91fv6gH6Df0KD1Wv68/0B/pOfoT/an+Rn+r1+rv9Dr9vV6vf9Ab9Ea9SW/WW/RWvU1v 1zv0Tv2j/smqZFX2v9tqrbd+sDZYG61N1mZri7XV2mZtt3ZYO60frZ+sn61d1m5rj7XX2mft tw5YB61D1mHriPWLddQ6Zh23TlgnrVPWaeuMddY6Z523LlgXrUvWZeuKddWO2nHmDlPNVDc1 zJ2mprnL1DK1TR1T19Qzd5v6poFpaBqZxuYe08Tca+4z95sHzIOmqXnIPGyamebmEfOoaWFa mlac2nBqx6mD6WgeM53M4+YJ09l0MU+arqabSTHdTQ/T0zxlnjbPcOpleptnTR/znHne9DUv mH6mv3nRDDADzSAz2LxkhpiXzSvmVfOaed0MNW+YYWa4GWHeNCPNKDPajDFjzTgz3kwwE80k M9m8ZaaYd8ws866Zbd4z75sPzIfmIzPHfGzm+t9+NZ+a+eYz87lZYBaaL8wis9gsMUvNMrPc rDArzSqz2nxpvjJrzNfmG/OtWWu+M+vM92a9+cFsMBvNJrPZbDFbzTaz3ewwO82P5ifzs9ll dps9Zq/ZZ/abA+agOWQOmyPmF3PUHDPHzQlzzpw3F8xFc8lcNlfM1TCE0Uw108zbZrqZYWaa k+aUOW3OmLPOU87TzjPOv5xeTm/nWaeP85zzvNPXecHp5/R3XnT/5fZye7vPun3c59zn3b7u C24/90V3gDvQHeQOdl9yh7gvu6+4r7qvuaPdMe5Yd5w73p3gTnQnuZPdt9wp7lR3mvu2O92d 4c5033HfdWe777nvux+4H7ofuXPcj90v3EXuYneJu9Rd5i53V7hful+5X7vfuN+6a93v3HXu 9+569wd3g7vJ/cnd5e5x97kH3EPuUfe4e9I95Z52z7hn3XPuefeCe9G95F5xr3rgoac87Vme 7YW8Xd5ub4+319vn7fcOeAe9Q95h74j3i3fUO+Yd9054J71T3mnvjHfWO+ed9y54F71L3mXv inc1ClGMqqiOWlE7GoqaaDgaiTpRN+pFo1GKxkRjo5micdHM0fholmjWaLZoQjR7NDGaI5oz miuaO3pTNE80bzRfNH+0QLRgtFB0THRsdFx0fHRCdGJ0UnRy9K3olOjU6LTo29HpcvVZVmRl ZbSPmqDYg8p65yRdh+P7D/puju8bdVP9EGzWzfUjsFVi6HbdRXeBHRzxnoedeqgeCrv0SD0S dktk3yNxa6/ErX0St/ZL3Dqg5+p5cFAixGGrglURQdZNle3YDibZsXYsJsvKaJnQT6G9uN8k mbL4i6ySnnQGOGOUcqY6X6hszmrnnCoja6UtZZV0Gkf7ExBhdpCPY359ZkCjOQIsZO/Mf8Lt D4pWS26W5PxrNLGQFXK6K7m80V3FcrO7muVWd821YzdybjGEmUskQG5mAMVSrx65m/3t7laW X7nbWX7t7mT5rXvE/yVl8c9IWf0zUjb/jHKuy3LWX6/RRLi0nByWK8lNtydG9sTKnkzp9iTI nuyyJ1H2KIhwryVx35VX/teSKqlKoFRNVRO0qq1qg6UaqAZgO284b0DImefMA+Mcc47x+ZQ9 XX33X4qx6SPs/9vx9X9PhPVj6I3Gzf9mzIwzrU1b0978iyOQHznv5JhZT6JZI45Mr0icfIBj pB8dU2NjmxuMir3+IB7+PhqO4jj4WwRMG13+b4uG16Idx8WRHL/TRsU7mH343COVefi8oyEz j/MB77jIrONBZhzjhXNMYMZxga32PrbUR3y7/DV2qsfTx00v1svkxXmZvXgvi5fVy+YleNm9 RC+Hl9PL5eX2bvLyeHm9fF5+r4BX0CvkFfaKeEW9YteNtv2vH28pQg65NxR1Z/0+7lIMxVKm 30Xfle4qd7XE4DXXjcIbOQ5vdre6292dv8ZjykrZJCYf+bdR+fLv4zIlUHZK/EvROV1s9i7/ b4jO9VFhFp7KJmIRiMeG2ATyy5XSItgc20BxbIft4GbsgB2gLD6Gj8Mt2BmfgfLYC4dDDRyN 46A5fozfQkvVVaVAb9VD9YbnVB/1PAxUL6gB8JIapF6G19SraigMl2ueo9QIxd5e5vjjtafj YIKO1/EwTWfVxeBtXUKXhs91sq4BiyTir5eI/4PM3jZYk61v4aCdyc6ECfYZ+wxmt8/Z5zDR vmBfwBwhhgtzhgaFXsZcoVdDb2C+0PDQSCwcGh0ah8VDE0IzsXRoVmgOVgrNDa3AGqFVobV4 b2hDaAM2D20ObcVHQttDO7Elc4PL2CZ0lblBX1POVMJPzG2mKi4MFw0Xw8XhEuHSuDScHE7G leFy4XK4KlwhXAFX+9fP8Mvw7eHb8atwtXA1XBOuGa6JX4drh2vjN+F64Xr4bbhJuAmuDd8f vh+/CzcNN8V14UfCrfD7cIdwB9wU4Wk/bnZaOq1wi9PGaY/bnI5OCv7o9HB64CGOs2PwMMfZ L/A0x9lzeMVV7kPKuM3cZ1QLb4L3s+oTfTk6Wi1Nvb+FZ6Oz5YpLM2wbbJmbZgtCRQgF3KMQ c5qyvH8qJ1/OZlYwVbRfWhCUFnBpOyf/LpviWJytphSW4nBXHsvzOe/Cuzi41MW6YOFIHCl3 2ayCFnaincPOaeeyc9s32XnsvHY+O79dwC5oF7IL20XsonYxu7hdwi5pl7JL20l2sl3Gvhm/ x/X4A27AjbgJN+MW3IrbcDvuwJ34I/6EP+Mu3I17cC/uw/14AA/iITxsacvSZ/RZfU6f1xf0 RX1JX9ZX9NW/s83iplhKVhoseVohk1zNSuCkIScni5ErzC0tAf59aaU5hRnViswTK3NyoAon F2rAneBBXU4E93OKgQehKfPD5pzioDWnzNCeUzx0gxTIAk/DM5AN+nDKzqNTQSLGYCzk4DGa CLkwN+aG3HJPw008XhtCHh6vTSGvXNXNJyM1P3bCTlBA7nIoiN2xBxTC3tibx/QgHARF8SUc AsXwNXwNSvAIHg0leQR/DKVwES6G0rgCV0IyrsE1cLOsN5WVkVdOOHUdWXVqLqtOj8paWGKa tbCScjdVJfUwI5ZLJatkZo7lVDn/GTFVg/fUUXWYOTZWjZk53q/uB5v5TxsIMfN5jJnjQGcw hJ0hzmvgOtOctyHWmeHMgjhng7MRsjqbnW2Q4Ox0djGn7uU+C3k5ivSDAn6EgKIcISZBcd+f Q2n25xsgmb34driFPflOKMe+fBfcyv58D5TnOdY+qMA+/QBUZL9+CCqxbz/CfZWxLaWkLbVV R25L7nRtqaAq8B6/RVo15DmNJS2ypUUh5nlNwUi7wszinoSItMuRdkWlXXHSrnhntvM+t+hD Zy7kkDbmkTbmc/Y5B6CQc8g5yu3yW1pKWposLS0nLS3PcXAqzxPe5tlGVWn1ndLquzg+nYG6 HJ0u8wwl9eqr/5Rja2lRab+N/pv2oGLQxtLBMUV49L6GI65tUzgT3+dS/LXjeARcB4PKinET JCzpW1vwCAkeRvAICx4R5r3NwBFUXOltT7CJOg86DwLxzPxZiOHZ11Du82HOGMjJc7C5UMD5 xPkCyvFM7ChUcY4756ANc4gB8DizhdfgGWYHs6Avx/6PYTjH+s0wTvr8E+nzTzmC/wTzpec/ k57/XHp+gfT8Qun5L6TnF3FkPwqLObofhyUc4S/DUo7nIfiGOU4CbGBekxd2MJcpBnuZlbjw C7OLTHCcY3wizwDYE/IM6UkAfwYJ1fxVBmjk320D97j/8u6Eb/g3uXDUDR8nb7v8Lx19zR6g pfRqkth8wzT2kPSbPUATqHJtm4Kacu0+/tpxCrQz1pnCf3ORs4pt/LzrjxzeKrP81JrklTok BbX8ta4V2Zv9Be/Ov8wivhDEF6L4Qi2+0BJfaIsvDIkvNOILw+ILI+ILHfGFrvhCT3whiS+M EV8YK74wTnxhZvGF8eILs4gvzCa+0H+2eQm3wFO19Hy4/Q+vBSl0MI5rmQ+LYRmsiNWwDjbm 2rXEjtgFezB/6osD8RUcxn91Ik7DWfghfoILcRl+iWsZm22Mw378BU/hBQ5AIeWpOJWgcqsC qhhjXA6LceuLMBYlRTflCOzrZlhBdHOsKPoRrCT6UawsugXeJrolVhHdCquKbo23i26Dd4hu izVEd8CaojtxVPd1Z2wgerSdzdfWXDtB9Dw7u6/pYtj1tZ057Pk6NCUcFb0gTKIXhmNEXw7H ir4SziT6ajjO18ygMouuGoPydzpiUfZGMcw1FJdKsGzKjMPnL+yTuJVsidzGZJaPYhmWLfBm li2RuQy37RaWrbEcyzZ4K8u2WM2//wSrs3wM72TZiTmL4lbVYtkFa7N8Euuw7Ir1WI7Gu1mO xfosx9jxoLi9WVjOs/3Vl4th7hhuKVs1t9NiuSDMnIfbGPLvqAobllfCYZZXwxFQ3DZmYOGq UJTH1sMc8ztxrO8F/WAIDIOxMAVmwRz4HJbBGlgP22A3HGb/ElxTZEtKYFsvwLaUhOWwMltT LayPTRiNR7lVnXAmozWaEXpHdDOcJbo5viv6EZwt+lF8T3RL9u6+boUfiG6BH4pujR+JboNz RLcN5/I1tzG3r7mVN4leEM4jemE4r+jL4Xyir4Tzi74aLuBrbnFB0VVxvPTfBOm5idJzk6Tn JkvPvSV9NkX6bKr04jTpubel56ZLz83w+yMcL4hnEcSzCuLZBPEEQTy7IJ4oiOcQxHMK4ghW DMid5Vp8BchIxxj/MRH/bcL15b7+IlBGeICshmFWsbVsYiMJ/t/2z4LZr+Xa+5bk+172JyPE VkT6V+kwlj0UYBaeV6F4IiX+xY+rCTAI78X78UF8AO/D9s4DHAGbpq5Nq+7qWTVQDdej9Qz9 IV2iy3SFrrKXHeeMdyY4E51JzmTnLWcKe9zFzhJnqbPMWe6scFY6q+gsKdJkkU0hMhR2zjsX nIvOJeeyc8W56rLbc193h7pvuMPc4e4I9013pDvKnevOcz9xP3Xnu5+5n7sL3IXuFnebu8P9 0f3Z3e3udfe7B93D7i/uMfeEZ7ywF/Ecz/U8L+qRF+MV90p4Jb1SXmkvyUv2yng3e2W9W7xy 3q1eea+CV9Gr5FX2bvOqeFW92707vGpeda+Gdyd5FCWiOMpM8XSOztMFykE5yb8OWkhmniCz TZtZV12OaR1VJ2YOKTyr9FRvnlVG5b5ZkjlkjMwMY2X9N5P+QH8AcaH3Qu9D5tC80DzIEjob OsuckedLkM2fLzG32uHsgaL+rImZ1EDmDxXdd5k5VOcZ/2aox7P+rXC38If6wh8aCH9oKPyh kfCHxsIf7hH+0ET4w73CH+4T/nC/8IcH3CvMHB70YpkttBS20FvYwnOUhdnCC9zO+dD0Rnr0 r/Xgf6Wffu0hR9AEQTMiOMYJjjkExwLS8pLS8nLS8kbS8ibCk+5PnX3a8rVBztcBf225GuRO a/8Zrfjf22Oq7fAZMomlgFiKlh4OSX+S9GeM9Ges9Gcm6c846c/M0p/x0p9ZpD+zSn9mk/5M kP7MLv2ZyP2WDXIEtXdtSlN7Ys4bjFh/zIudgtgpip0qsVMd/NazY9L8NoFZyTUv8OtIF88h o0As2RZLNmLJ4dSZNB7HM3gxYAOZVFaVQ+VXRXVtu5Xdxm5nd7C72d3tnpSX8lNBKkxFqTiV pNKUTGWpHJWnilSZqtDtVI1qUC1qTq2pLbWnx6kzPUndqSc9TX3oeepPA2kwvUyv0lAaRiNo JI2msTSeJtJkmkLTaDrNpFk0mz6gj+hjmkef0me0kBbTUlpOK2k1fUVf07f0HX1PP9BG2kxb aScdoWN0gk7RmX+e9Pjnvs//2JMescz529qZ6SLH/Ko3dF87j0TsGNqW5i7ksH+XzrV7fP6H +3Su3eHD51C3qeZpVjr8LXXZA11bL8BTcJY5+i2qPB9Rnbc1UI3UfepB9bBqzb6qC3u93v51 tesl/1pa2sRnSZ/K/z75V97SJv863XVT9Qyppn8VL11q8PvkX9FLm7gt/yZxPEiXuM3p04PX Sxw/0iVGKX1qLum3cusMqR2njv8mdblecq+kTxy10qfsGVK+9CloX2p95Qz/rI/8m/URhB0c PytzrK/FLLuJvIvl1zew+G9jGQyvwQie/UyG6TCb5z/zYRGs4BnQOtjE+CXJ9eY/K8v/Jdng r8jrroKkrpF4rEb48x64w58LcKzLKrMH/zoLYlGeRyuO9sM5PwLf5PxI9L8gPp5nXgo/xqP+ W2jxOM9XTsh3OE7jGc6fxfMSMy9y/hJe4fxV5X8FRSmLbc5WIc4b5b+51VU8/1ZR+aZIrOI5 topT8ZzPorJyPpv/jRCOqzk4n1Pl5Xw+xTM3VcD/+gjH2KKcL6aKcb64Ks75EqoE+F9VKcn5 Usr/GtAYNYbzY9VYzo9T4zg/Xt8lb5KtDVrXsTP776qzub12on2n/3ZF+y7Qdi27hf+ucLsD 5zv6XybmWN2T80/5b62y+9v9Of+ivQj8rywv5vySMHvmsOJZpAoXijwGGOkUYaYXeTw6AzA6 M8qz3ug70cWcXxJdzvkVzFSRcjPP0Mwmr8oMj71yjIrJm/qctfSMgpbB08G/cRAUDoLCQTDN U6woHASFg6BwEBQOgvLsCQoHQeEgKBwEhYOgcBAUDoLCQVJrqISJoDARFCaCwkRQmAgKE0Fh IihMBIWJoDARFCaCwkRQmAgKE0FhIihMBIWJoDARFCaCwkRQmAgKE0FhIihMBIWJoDARFCaC wkRQmAgKE0FhIihMBIWJoDARFCaCwkRQmAgKE0FhIihMBIWJoDARFCaCwkRQmAgKE0FhIihM BIWJoDARFCaCwkRQmAgKE0FhIihMBIWJoDARFCaCwkRQmAgKE0FhIihMBIWJoDARFCaCwkRQ mAgKE0FhIihMBIWJoDARFCaCwkRQmAgKE/n1HSXX3liSoxvreNkKOR5L6pujXShS7MVaL56N olET++Z4gDc1UYjJblIkZBcnrRJtSGoRcoqH0MK+tyq0Jt6T1CipRJotOSfnfi6nXFKqDA2g JXSDzuxE20AK//cvMVVJypvmZFZ8YfNWg/InSw46UA0Tnjw0eMuB6p+tndg3a7GkvlZcUl91 YaJWqNg5LIaXKlcemOm7KmdaHd55e1L0Wk3R4jp1SS6eVDSk77XczPmqd+7ydNcO7dqn5CnS qmie5AoVbs1zd4dWXTt369w2JU/1zl27lErOnZQz9eAs6fd07toipUPnJ5LzJt3k79eZE37b 37hz55Q8d3RPad+5a4eUp5NyZ4tWuDUpOTkp6dYk/tc0W7RMUnKZm5OD4v+BGvXFfGlh8b9U 1ZfdCm93VF9EmKEWLO6yt9KJ+jmKTHjzqeZJByfPeLngI+euDK/31rwr4ybnqdKr0eQxk199 tMxj31Vr/fQvs3qsbrLlxKGxL+Z8dUK/th8tf+yZlvk35Kq8IwaH7h+x7IuSbUePbl9o1NqK Jb7wPn6g0OKa+5wq5UeUmFGkwvTDtV+otqtfzGejO93bYlbfXpMeLdmz3oFRc1pXGt0wZ3K4 QPyEGfteL57wv6o783gouy+Aj1nshFGW7FuyPjPWIVsMZc+IFsrOiDEx2bexy5alxCtrlpIl hEJosWVJRSF7iwjZifiN3npTb++nP35Ln9/8M3POee69Z557zvfec5/5fOaN0mVrZotjMNsM Tjmj8JX82SRw096n9UfR5ZGB9QrvjZP0iz/lezsT9EtY2y9RCfOCTC9YYOVqdJgoDphsnVy/ akdNmfeEaGI6W6l4ag/RA9q/fLc48OJmaUdAbz67q9mBttoPlDl8QDl5aGs5jwc8dBgMIQV+ DrEAIOYCxGzS3eQkgxJTAWJyIMPJx/hZrGs6/xF/5jK92K1HWa7/+/kL+kWMQ7bn8OIETUPM QjKrzHQ1mcALD8YFMwtkRjrNI2VYfERcq8Ib3vkPpolitzK1WqxmN563KyqeuCZrjN0UcFZp bb8+BPMdRMQoZTDgHWs2mQxYsQ0bj9XHGU/wGExa+ZRcZ2sRlRMUv2ubxXRecJd1zooxxxpv a+/uBaMbOHUkxacgltXX9k50R5br5oya694+ADZ4EFQRnBf3s+v1cIJz5wJHIBUnF28OtpjO 2B5uNjKurIAIM21d6P1AGedfnfywUE7slferAo9x90zQY0eVxiey50fUmApkHPc6DsiMPuOA vipAQ1tOSMnj9DjorKqos6Of9hiraHZwHM3DDzAphCeey8h/kkmiggUQBNH9kwrUEoWMLw23 zK48avjKFM7fBQNS3ssjSS8SAZAkGCCQJFHmKwy8PhOU1Ak5HHwUg4ADjNsCJZza1NLNAYuz J5CGYQDot5UUcAojWxtnF5zNV8eo/8kxfoD3T8fYd9ptbHkwWHscqVceQ3W1X1Khysuv17wc jSqQvoHoXxOUOezRsM6d3ow+O9utOfEs+v4ZXSOrxRTwfb0Xh50kBZRt6zv5q2gOVQWcG0TX XY+jN3woKDqf+ZaOn7tbTeCjVUoXGzo3UZs7paNcku++trivS99uLsVoFANqsG7/op2iOBly a3PfobxbTmThaet3yqwDgtbMMokhobGl89VJOV3yeYahLPvC9QeBZZDSYtOaEvFu2LQTKl9C erlCooTazyre0y7tshtdWMn8gwWe2wZMMdaPxPqQaLaZGu1LioYY1k67I17Xi8JbTJQzggwj cLCbMo0+AnVGdkop+u2i/lK4EC3y7vTH2mFgXBjoakP4MOYLFT4CxBUAvg0FQSgtQE1OSVrQ YDAKCOT/AxW7tn2Eb//tJAyAkN4Azm0FPXQPlLmds9MdhD9ZMtf/QD/1iIZEjob1B4Bm27wL CiWlUdiO1PnMGJ/CYn9tofnOWn1C9rF9BJFz5WGfCnWTPEF679qmWF9iH9Jn+y6A1ZvawttX Me33MupMXD5Ya1zTAM1caknt4aimyWCjS3rez1W03292Os/tRtwQKlbpsmOtvPOTiBL+T8Pv erFU8RF1m6OgGumFFd81BiYJ2NT+S4kHzwifrZKPG6GgazV36KgLVDtjV1BTVRMr3TYPYfD1 XnoycnDYZ3N09Mbm8nAPXTm+N2HcoFI+21f8mdKANI2VHDiD6MgfuWxmHVd6ogb13CL6aAi7 1JLi5cwg2uzTUeViVVm5jwr7eSrrAbZQHmY6kVqjRbWRU8B4gjA2vBE/tpBf2Bl40NWdnsQY RxJjjL4wxnKXp97nHRJkZx7BSJz5jVn9FThSAEAijhQJOAAKQG6LUtsiQPivuPbFDvkH+y9Z kz1AHdN1r/HwHx3XFaSL+I+fGXC6y8tXldQyWVzf1CN0D8kYVdtvLrYua8K1W7Q4jm6QOQcn rBuwR0XtRozqTc0Iuj5iUlEy+WNTDXezybkN+rEAQo7UI8Lr2XHLLH9IFXqrR5mpp7TtFN1j n/kqON2GhaNw6LnoqqLa0AmWigt3l/ZUWplPMw4rzPCejCoJdLuPHr8Y6WHxx9sij0a5GClm SfiAVWsx+zWDy/ZFz3hQwNmRGHvNsSaORTpDgprkBEzAkffM4dKEB2Wo5oO5zmas2oVxz2OD lT2ptV5cLQvhvz8272N3U5tQJ6Smk2bJbKEPtAQtPKbB+84c1fN4QnnUnfiFNasAcenzvefc tZ2xpCQkb9iRsAu8qrG+R1aNdS6/ZnnuGCwNkxCa+DmatjnByQ9lBfYE/jzNNbYv4IYqAYoA KlMuUyZMyoFAwCtISlq7Okk4f51DCWsXZ0n8Gey2VhLv6mJzzprgJqmOIQWaBEkFHPo6JGkf cgBQAOS/ygA4TOxLhx4eHj/r0NZ1R0+EHxLoM21UTV0w9uk8wdJk9G9YdA4UTb0gBszQeRE8 DJK1WBdAu7H+A1YXsj/ZZ6W9Et7/8ejzlE3D+lNU5bfzpoMWLnO5HP+4NDdK+zSKUnkPC093 wy20FqWQhSmVTtIHyvY7ergPY4eYhGWieF2HT1eWYJkEkmbeSVMN+ONcEqiN2kR0D19HioVN ZLWbC9XWHhg5WRZMc0eGwyAErbVVk5R1nOLapUHPOtOA3Hz99vmitFS1sUdmAsovA6S19Je7 WnyuTFW2plkzY0qKUmef13dlZhVebPMWDRdraO7bcIL018sXzXWbsbHsalhpC8xjoGQfvMD/ tjRLV3mylFHIk75R7PbVM81xB0i0uUKiTehX2hz2nf5MG9jvo40x1tnWjWDpjN9JG1kAhZAF EDIyyM/bG8RnEQlsiwAx77/i2z5A8M+FkgunjsU72LryaGDQPGiMvgIC0JAXl5GXlhNXP6gp //VCCJzrH74ExtbVHWtt+0tATd6BWbf0eRWHaCjnlj+Y1k0XGEa5c1H1IrWPeT4R7culuDD7 Vmm9Tsg3Z/21nz+yq08pCiU3v/pCUXrPs4Sgden3DqGu7HEj1boj1aELUtTgxmx3Nxld87mq UW0/zuokz4EtrtDdBzXPdgbsM2XqDjZQ7Po4tBw1rQIa7xmyXGOJ0blKPLCEVZ0cjaynMLhD 8HlH+1prstBprseeSLm6p80PXuM2RqX70Wp9OhOVqrA5xdhiyWV17AW1cXCPoo7O2NE6SQv2 2ASYer/5VBA1fzJVJgxhG5Woz6XGm51w4RNaA+0icxMtV4S9ZrsmrX6T5Z4iapQhep49fNzY kFvxCqJoJ6C+Acnf9YOEisn+EcEVh2qyDZ1R/65x5e/Y4zKhr5J8W7pQJyyuNm3yhqKaetPj f4s9BDe8teV/hD1feyL8jKCUf6PwTwCF9Q6iot3TPdSlGSlR3y3tTQzYJ6wmsvCUN4E+ueg0 5tT+telGY+0CvxX4YxrmNb35sN0g3HgwpzA6XwyFHHRJlTsxw28UZwyJUclPs5Fflm1hVq9U UL7cSnf/LFF4wS4fMWZmHrdmZDRqNpV44QqWSjeyu9tdV5rOcdRXI1/0ZLBxAFqATfDBec2H guNsgdj9zMssTR/4xIiap0QX1/KaPJT5XdbybEJjs63orolzFby+oBywVRq7kfx+7hO0pONw 5wnCjY8LcO69qM6cit7axYqZlqJ5E671A3MtvSIatfVpKn52rB1lPNbUbapKtkg237JqpUah Q/p8bCm4aKBxLv57QDE40qQYNIAECxkH0NzHvO2zf8TU7ym+vtAJkJaW26YTiiT+huLrb+D8 FW9eyuHWS1oOap9lbek8pIxp+FjIfEcMWcNkYNQSPK0s1XcYkSBcGW8zwm0YcueeTncAbHX2 3N2o5oKeYizeznOf3URl1Wzo7Y6Z65+YrtIc59sv2aXaZwLd637L2cZZ23hgcG6oPiO4OXA4 QBcsl7TUkE5pwuWg1dHX4G4m6VcpCK0wOenIYb0V6HtgpgcqqIfyIFCY3zN7ESYndq6VfpIL ReXrvnnFCec98l45Ljn9LP1pEQNWKwtk+pNgfVE+Mwd01JBkCINh2dot9hinGcE/4KuPGJ6H 0i8GubvJNl30zm63IH8PKw2TqlpNOhmiFnIsNAlXyi12qN0lTX3EcSJAKPbMn7wJIhMm3RGB n2fo/0X5xUBO9eUAdDfZdk0F2kHPn8KR7a8GzGAoLRc1CAM6B7ICqYPUvi/N/lbX/QRQSXqM iHu+hjWMsVmWFGT00Xh0zKybcZ0KFUx8q/oIJpRjGhVflWNCMxRdqbi3e/1GfmvVzSO8e10o sf5nINl8mtNOFc6+fNWaT0MWYnbdpTgv2zjl/w5vjs5IeNLeORjbMFov0uH7vrUY2RN++5H1 A9luVt569yHF1PK9bum8ES8qKpiMoxfT7tlqpwoLpVmc36XYDLf1PFTTVRSsYFBqdWwIePcO xTkeOd+PIq7BeaNtAq3JoZfmU8Hqkj6aEXe2wH22a9pD/RBCYjkMR9t+5aWwpe+hOZY0Rl55 MEf4DfKHl5DVr1WbMEp11yKHJuzkYhb5LqW1l3oYH1HoddUo419GBEFLSJAqBJORAcTw31iV fVcrfjvjziT2A8x/zbcwGYICAvv86+XtKPgymVQQBO3OY3WSN98kGgQ9sNO6G+D/1hCKIMXY Spw2BVEnfugWZaphaWT9J2GD+FuAzY4mtAgTwDhTJFAYpAfCgqxBriCXzyfzdiACiAdkDPIC 4UmSPUlvSfrkAPLKEgoU+MflleCFd7F3tcQ7ePH8gDdoEBmIp/5N9XE2kAJzKnuEXufCxdK0 RNXsSXopU+iMvJvmxsbN4pTZEWDc//zS1CLEZ6nHbG2JcCWQBlfeXywJwUHxk5DeZZZI8YaQ i3K5Xcoh5qb0Xq0v2F7Uf5KKSn9ZzpNdpTl12z9juqRBuWmyXmO4W6129R0z23mduUQydNdp KdqogOLoHPWYlg39LeuihPsdiH1H3SosquKhK6107sWHPIvBqYFtxfHSskJNb2xoM2PBrc7c fsX+JjIPnsJ9yw7yXUzp8tbHu+cUiz7ke+vt9tw8My5r1tQAARZlcNf4mKTJYZUE94nzfRXC P5Lzh74ctEnX7vpEbn/uMX6/SKCbmzkrCMwNBIH3fpsjckQQmJakovyfh+iPK9J3BQbFlxDN NAdYd0YizbenQGSkMf+ywBC7SEutPAJAkhZaJEpK5sTfAhG8JUA/XGkZYy5xGohAsy+VjLxf /YFZ2yEynHxfm1J8uLp1b14fL6yZ9r1dmMDWQXCX+oe6liwe90tjtaOJsUyqY0Ii2XnxUZbR rGvtIjcN2cNXfeInMQ9VJ2rEzeM6NRJscCYWggdpmsPAgWozfCk+D5HehjNOEa8+yrIsNUUl WHEapz57DWfK6r1SvLJlqgDRetczc2zBTlnNXudU1d26vlDxV6bVLfGFVmcdVfLhlPe6RNvP DaWc9/LEBxdppt4rD47U11IQDcbwIgs2J5tVCO7ghuLrrhjzaodm/ymEkkPqvsCFCvLSt0+r GcWCnjjVlwyfLZsItiqoJHMH+ulVMWUnYQsrFbI2MAzv7ih7TRyDo/NxuBGugg70L7QkIlcN CmVuZHN0cmVhbQ0KZW5kb2JqDQo4NyAwIG9iag0KWyAwWyA1MDddICAzWyAyMjYgNTc5XSAg MTdbIDU0NCA1MzNdICAyNFsgNjE1XSAgMjhbIDQ4OF0gIDM4WyA0NTldICA0NFsgNjIzXSAg NDdbIDI1Ml0gIDU4WyAzMTldICA2OFsgODU1IDY0Nl0gIDc1WyA2NjJdICA4N1sgNTE3XSAg OTBbIDU0M10gIDk0WyA0NTldICAxMDBbIDQ4N10gIDEwNFsgNjQyXSAgMTE1WyA1NjcgODkw XSAgMTIxWyA1MTldICAyNThbIDQ3OV0gIDI3MVsgNTI1IDQyM10gIDI4MlsgNTI1XSAgMjg2 WyA0OThdICAyOTZbIDMwNV0gIDMzNlsgNDcxXSAgMzQ2WyA1MjVdICAzNDlbIDIzMF0gIDM2 MVsgMjM5XSAgMzY0WyA0NTVdICAzNjdbIDIzMF0gIDM3M1sgNzk5IDUyNV0gIDM4MVsgNTI3 XSAgMzkzWyA1MjVdICAzOTVbIDUyNSAzNDldICA0MDBbIDM5MV0gIDQxMFsgMzM1XSAgNDM3 WyA1MjVdICA0NDhbIDQ1MiA3MTVdICA0NTVbIDQ1M10gIDg1M1sgMjUwIDI2OCAyNjggMjUy XSAgODgyWyAzMDZdICA4ODRbIDQ5OF0gIDkxOVsgNDAxIDY4Ml0gIDkyM1sgODk0XSAgMTAw NFsgNTA3IDUwNyA1MDddICAxMDA4WyA1MDcgNTA3IDUwNyA1MDcgNTA3XSBdIA0KZW5kb2Jq DQo4OCAwIG9iag0KWyAyMjYgMCA0MDEgMCAwIDAgNjgyIDAgMCAwIDAgMCAyNTAgMzA2IDI1 MiAwIDUwNyA1MDcgNTA3IDAgNTA3IDUwNyA1MDcgNTA3IDUwNyAwIDI2OCAyNjggMCAwIDAg MCA4OTQgNTc5IDU0NCA1MzMgNjE1IDQ4OCA0NTkgMCA2MjMgMjUyIDMxOSAwIDAgODU1IDY0 NiA2NjIgNTE3IDAgNTQzIDQ1OSA0ODcgNjQyIDU2NyA4OTAgNTE5IDAgMCAwIDAgMCAwIDAg MCA0NzkgNTI1IDQyMyA1MjUgNDk4IDMwNSA0NzEgNTI1IDIzMCAyMzkgNDU1IDIzMCA3OTkg NTI1IDUyNyA1MjUgNTI1IDM0OSAzOTEgMzM1IDUyNSA0NTIgNzE1IDAgNDUzXSANCmVuZG9i ag0KODkgMCBvYmoNCjw8L1R5cGUvWFJlZi9TaXplIDg5L1dbIDEgNCAyXSAvUm9vdCAxIDAg Ui9JbmZvIDMwIDAgUi9JRFs8RUJGMkRGN0VFRDY0Njg0RkI4NjIxNTdGOTlFNjcwMzg+PEVC RjJERjdFRUQ2NDY4NEZCODYyMTU3Rjk5RTY3MDM4Pl0gL0ZpbHRlci9GbGF0ZURlY29kZS9M ZW5ndGggMjYyPj4NCnN0cmVhbQ0KeJw10L0vQ1EYx/Fzr9bLvVxa728tqnW9biISFolF/AdW 76VIKp0kFkP/A0tNYsFmkfgHjIbabQajzVDn/L6c4XzyJM/v5DmPMfY0Gp69U8Y4LuBF+FmR vhTxCpyJtS+xXRM7G2J3GT7E3pvYJ35wLg4LosjTxVdx9CyOV2ELfkRpXZwsitOKKC+J6re4 vxMPjw4vWLCT2z/kzTTMwCzE8NcyZwNh7r/ywIcmSMA8JKEZWqAV2iCAENqhAyLohC5IQRq6 oQd6oQ/6YQAGYQiGYQRGIQNZGINxmIAcTEIeCjBl1xOVtNaoCreiVhc3Tw6/fi3erxyJICPC TUey/CkqsTG/Lv0vnQ0KZW5kc3RyZWFtDQplbmRvYmoNCnhyZWYNCjAgOTANCjAwMDAwMDAw MzEgNjU1MzUgZg0KMDAwMDAwMDAxNyAwMDAwMCBuDQowMDAwMDAwMTI1IDAwMDAwIG4NCjAw MDAwMDAxODggMDAwMDAgbg0KMDAwMDAwMDU0MyAwMDAwMCBuDQowMDAwMDA0NzM2IDAwMDAw IG4NCjAwMDAwMTAzMDAgMDAwMDAgbg0KMDAwMDAxMDM1MyAwMDAwMCBuDQowMDAwMDE3MTMy IDAwMDAwIG4NCjAwMDAwMjU3NTcgMDAwMDAgbg0KMDAwMDAyNTkzMCAwMDAwMCBuDQowMDAw MDI2MTY5IDAwMDAwIG4NCjAwMDAwMjYzMzcgMDAwMDAgbg0KMDAwMDAyNjU3NyAwMDAwMCBu DQowMDAwMDI2NzUyIDAwMDAwIG4NCjAwMDAwMjY5OTcgMDAwMDAgbg0KMDAwMDAyNzE3NCAw MDAwMCBuDQowMDAwMDI3NDIzIDAwMDAwIG4NCjAwMDAwMjc1OTMgMDAwMDAgbg0KMDAwMDAy NzgzMyAwMDAwMCBuDQowMDAwMDI3OTY1IDAwMDAwIG4NCjAwMDAwMjc5OTUgMDAwMDAgbg0K MDAwMDAyODE1NSAwMDAwMCBuDQowMDAwMDI4MjI5IDAwMDAwIG4NCjAwMDAwMjg0NjkgMDAw MDAgbg0KMDAwMDAyODc5MSAwMDAwMCBuDQowMDAwMDI5NzUxIDAwMDAwIG4NCjAwMDAwMzUz MTYgMDAwMDAgbg0KMDAwMDA0Mzk0MiAwMDAwMCBuDQowMDAwMDQ0MjA1IDAwMDAwIG4NCjAw MDAwNjgxNDIgMDAwMDAgbg0KMDAwMDAwMDAzMiA2NTUzNSBmDQowMDAwMDAwMDMzIDY1NTM1 IGYNCjAwMDAwMDAwMzQgNjU1MzUgZg0KMDAwMDAwMDAzNSA2NTUzNSBmDQowMDAwMDAwMDM2 IDY1NTM1IGYNCjAwMDAwMDAwMzcgNjU1MzUgZg0KMDAwMDAwMDAzOCA2NTUzNSBmDQowMDAw MDAwMDM5IDY1NTM1IGYNCjAwMDAwMDAwNDAgNjU1MzUgZg0KMDAwMDAwMDA0MSA2NTUzNSBm DQowMDAwMDAwMDQyIDY1NTM1IGYNCjAwMDAwMDAwNDMgNjU1MzUgZg0KMDAwMDAwMDA0NCA2 NTUzNSBmDQowMDAwMDAwMDQ1IDY1NTM1IGYNCjAwMDAwMDAwNDYgNjU1MzUgZg0KMDAwMDAw MDA0NyA2NTUzNSBmDQowMDAwMDAwMDQ4IDY1NTM1IGYNCjAwMDAwMDAwNDkgNjU1MzUgZg0K MDAwMDAwMDA1MCA2NTUzNSBmDQowMDAwMDAwMDUxIDY1NTM1IGYNCjAwMDAwMDAwNTIgNjU1 MzUgZg0KMDAwMDAwMDA1MyA2NTUzNSBmDQowMDAwMDAwMDU0IDY1NTM1IGYNCjAwMDAwMDAw NTUgNjU1MzUgZg0KMDAwMDAwMDA1NiA2NTUzNSBmDQowMDAwMDAwMDU3IDY1NTM1IGYNCjAw MDAwMDAwNTggNjU1MzUgZg0KMDAwMDAwMDA1OSA2NTUzNSBmDQowMDAwMDAwMDYwIDY1NTM1 IGYNCjAwMDAwMDAwNjEgNjU1MzUgZg0KMDAwMDAwMDA2MiA2NTUzNSBmDQowMDAwMDAwMDYz IDY1NTM1IGYNCjAwMDAwMDAwNjQgNjU1MzUgZg0KMDAwMDAwMDA2NSA2NTUzNSBmDQowMDAw MDAwMDY2IDY1NTM1IGYNCjAwMDAwMDAwNjcgNjU1MzUgZg0KMDAwMDAwMDA2OCA2NTUzNSBm DQowMDAwMDAwMDY5IDY1NTM1IGYNCjAwMDAwMDAwNzAgNjU1MzUgZg0KMDAwMDAwMDA3MSA2 NTUzNSBmDQowMDAwMDAwMDcyIDY1NTM1IGYNCjAwMDAwMDAwNzMgNjU1MzUgZg0KMDAwMDAw MDA3NCA2NTUzNSBmDQowMDAwMDAwMDc1IDY1NTM1IGYNCjAwMDAwMDAwNzYgNjU1MzUgZg0K MDAwMDAwMDA3NyA2NTUzNSBmDQowMDAwMDAwMDAwIDY1NTM1IGYNCjAwMDAwNjkyMzAgMDAw MDAgbg0KMDAwMDA2OTI1NyAwMDAwMCBuDQowMDAwMDY5Mjg0IDAwMDAwIG4NCjAwMDAxMDU5 NDEgMDAwMDAgbg0KMDAwMDEwNjE2NCAwMDAwMCBuDQowMDAwMTg1NzUyIDAwMDAwIG4NCjAw MDAxODU5ODkgMDAwMDAgbg0KMDAwMDI2NDczNCAwMDAwMCBuDQowMDAwMjY1MDM2IDAwMDAw IG4NCjAwMDAzNTc2MDggMDAwMDAgbg0KMDAwMDM1ODE4NCAwMDAwMCBuDQowMDAwMzU4NTA5 IDAwMDAwIG4NCnRyYWlsZXINCjw8L1NpemUgOTAvUm9vdCAxIDAgUi9JbmZvIDMwIDAgUi9J RFs8RUJGMkRGN0VFRDY0Njg0RkI4NjIxNTdGOTlFNjcwMzg+PEVCRjJERjdFRUQ2NDY4NEZC ODYyMTU3Rjk5RTY3MDM4Pl0gPj4NCnN0YXJ0eHJlZg0KMzU4OTcyDQolJUVPRg0KeHJlZg0K MCAwDQp0cmFpbGVyDQo8PC9TaXplIDkwL1Jvb3QgMSAwIFIvSW5mbyAzMCAwIFIvSURbPEVC RjJERjdFRUQ2NDY4NEZCODYyMTU3Rjk5RTY3MDM4PjxFQkYyREY3RUVENjQ2ODRGQjg2MjE1 N0Y5OUU2NzAzOD5dIC9QcmV2IDM1ODk3Mi9YUmVmU3RtIDM1ODUwOT4+DQpzdGFydHhyZWYN CjM2MDkzMA0KJSVFT0Y= --B_3552832744_1985436438--